@synth-deploy/server 0.1.0

package/dist/agent/debrief-retention.d.ts

@@ -0,0 +1,12 @@
+import type { PersistentDecisionDebrief } from "@synth-deploy/core";
+/**
+ * Runs a single retention pass: purges debrief entries older than
+ * the retention threshold.
+ */
+export declare function runRetentionPass(debrief: PersistentDecisionDebrief, retentionDays?: number): number;
+/**
+ * Starts a periodic retention scanner.
+ * Returns a cleanup function to stop the interval.
+ */
+export declare function startRetentionScanner(debrief: PersistentDecisionDebrief, intervalMs?: number, retentionDays?: number): () => void;
+//# sourceMappingURL=debrief-retention.d.ts.map

package/dist/agent/debrief-retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debrief-retention.d.ts","sourceRoot":"","sources":["../../src/agent/debrief-retention.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAUpE;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,yBAAyB,EAClC,aAAa,GAAE,MAA+B,GAC7C,MAAM,CAOR;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,yBAAyB,EAClC,UAAU,GAAE,MAAsC,EAClD,aAAa,GAAE,MAA+B,GAC7C,MAAM,IAAI,CASZ"}

package/dist/agent/debrief-retention.js

@@ -0,0 +1,27 @@
+const DEFAULT_RETENTION_DAYS = Number(process.env.SYNTH_DEBRIEF_RETENTION_DAYS ?? 90);
+const DEFAULT_RETENTION_INTERVAL_MS = Number(process.env.SYNTH_RETENTION_INTERVAL_MS ?? 24 * 60 * 60 * 1000);
+/**
+ * Runs a single retention pass: purges debrief entries older than
+ * the retention threshold.
+ */
+export function runRetentionPass(debrief, retentionDays = DEFAULT_RETENTION_DAYS) {
+    const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000);
+    const purged = debrief.purgeOlderThan(cutoff);
+    if (purged > 0) {
+        console.log(`[debrief-retention] Purged ${purged} entries older than ${retentionDays} days`);
+    }
+    return purged;
+}
+/**
+ * Starts a periodic retention scanner.
+ * Returns a cleanup function to stop the interval.
+ */
+export function startRetentionScanner(debrief, intervalMs = DEFAULT_RETENTION_INTERVAL_MS, retentionDays = DEFAULT_RETENTION_DAYS) {
+    // Run once on startup
+    runRetentionPass(debrief, retentionDays);
+    const timer = setInterval(() => {
+        runRetentionPass(debrief, retentionDays);
+    }, intervalMs);
+    return () => clearInterval(timer);
+}
+//# sourceMappingURL=debrief-retention.js.map

package/dist/agent/debrief-retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debrief-retention.js","sourceRoot":"","sources":["../../src/agent/debrief-retention.ts"],"names":[],"mappings":"AAEA,MAAM,sBAAsB,GAAG,MAAM,CACnC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAC/C,CAAC;AAEF,MAAM,6BAA6B,GAAG,MAAM,CAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAC/D,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAkC,EAClC,gBAAwB,sBAAsB;IAE9C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,8BAA8B,MAAM,uBAAuB,aAAa,OAAO,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAkC,EAClC,aAAqB,6BAA6B,EAClD,gBAAwB,sBAAsB;IAE9C,sBAAsB;IACtB,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAEzC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3C,CAAC,EAAE,UAAU,CAAC,CAAC;IAEf,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/dist/agent/envoy-client.d.ts

@@ -0,0 +1,216 @@
+import type { ServiceHealthChecker, HealthCheckResult } from "./health-checker.js";
+import type { DecisionType, DeploymentPlan, PlannedStep } from "@synth-deploy/core";
+export interface EnvoyDeployResult {
+    deploymentId: string;
+    success: boolean;
+    workspacePath: string;
+    artifacts: string[];
+    executionDurationMs: number;
+    totalDurationMs: number;
+    verificationPassed: boolean;
+    verificationChecks: Array<{
+        name: string;
+        passed: boolean;
+        detail: string;
+    }>;
+    failureReason: string | null;
+    debriefEntryIds: string[];
+    /** Full debrief entries from the Envoy — Command can ingest these */
+    debriefEntries: Array<{
+        id: string;
+        timestamp: string;
+        partitionId: string | null;
+        deploymentId: string | null;
+        agent: "server" | "envoy";
+        decisionType: DecisionType;
+        decision: string;
+        reasoning: string;
+        context: Record<string, unknown>;
+    }>;
+}
+export interface EnvoyHealthResponse {
+    status: "healthy" | "degraded";
+    service: string;
+    hostname: string;
+    os: string;
+    timestamp: string;
+    readiness: {
+        ready: boolean;
+        reason: string;
+    };
+    summary: {
+        totalDeployments: number;
+        succeeded: number;
+        failed: number;
+        executing: number;
+        environments: number;
+    };
+}
+/**
+ * HTTP client for communicating with a Envoy agent.
+ *
+ * Command uses this to:
+ * 1. Check if the Envoy is healthy (pre-flight health check)
+ * 2. Delegate deployment execution to the Envoy
+ * 3. Query the Envoy's local state
+ */
+export declare class EnvoyClient {
+    private baseUrl;
+    private timeoutMs;
+    constructor(baseUrl: string, timeoutMs?: number);
+    get url(): string;
+    /**
+     * Check Envoy health — used as the ServiceHealthChecker for the
+     * Command Agent's pre-flight health check step.
+     */
+    checkHealth(): Promise<EnvoyHealthResponse>;
+    /**
+     * Send a deployment instruction to the Envoy and wait for the result.
+     */
+    deploy(instruction: {
+        deploymentId: string;
+        partitionId: string;
+        environmentId: string;
+        operationId: string;
+        version: string;
+        variables: Record<string, string>;
+        environmentName: string;
+        partitionName: string;
+        progressCallbackUrl?: string;
+    }): Promise<EnvoyDeployResult>;
+    /**
+     * Dispatch an approved plan to the Envoy for deterministic execution.
+     */
+    executeApprovedPlan(params: {
+        deploymentId: string;
+        plan: DeploymentPlan;
+        rollbackPlan: DeploymentPlan;
+        artifactType: string;
+        artifactName: string;
+        environmentId: string;
+        progressCallbackUrl?: string;
+        callbackToken?: string;
+    }): Promise<EnvoyDeployResult>;
+    /**
+     * Ask the Envoy to produce a deployment plan (read-only reasoning phase).
+     * Returns the plan and rollback plan; the server then submits them to
+     * POST /api/deployments/:id/plan to move the deployment to awaiting_approval.
+     */
+    requestPlan(params: {
+        deploymentId: string;
+        artifact: {
+            id: string;
+            name: string;
+            type: string;
+            analysis: {
+                summary: string;
+                dependencies: string[];
+                configurationExpectations: Record<string, string>;
+                deploymentIntent?: string;
+                confidence: number;
+            };
+        };
+        environment: {
+            id: string;
+            name: string;
+            variables: Record<string, string>;
+        };
+        partition?: {
+            id: string;
+            name: string;
+            variables: Record<string, string>;
+        };
+        version: string;
+        resolvedVariables: Record<string, string>;
+        refinementFeedback?: string;
+    }): Promise<{
+        plan: DeploymentPlan;
+        rollbackPlan: DeploymentPlan;
+        delta?: string;
+        assessmentSummary?: string;
+        blocked?: boolean;
+        blockReason?: string;
+    }>;
+    /**
+     * Ask the Envoy to generate a rollback plan for a deployment that has
+     * already executed. Uses the execution record (what actually ran) rather
+     * than the forward plan, so the rollback is targeted to what actually changed.
+     */
+    requestRollbackPlan(params: {
+        deploymentId: string;
+        artifact: {
+            name: string;
+            type: string;
+            analysis: {
+                summary: string;
+                dependencies: string[];
+                configurationExpectations: Record<string, string>;
+                deploymentIntent?: string;
+                confidence: number;
+            };
+        };
+        environment: {
+            id: string;
+            name: string;
+        };
+        completedSteps: Array<{
+            description: string;
+            action: string;
+            target: string;
+            status: "completed" | "failed" | "rolled_back";
+            output?: string;
+        }>;
+        deployedVariables: Record<string, string>;
+        version: string;
+        failureReason?: string;
+    }): Promise<DeploymentPlan>;
+    /**
+     * Validate a modified plan against the Envoy's security boundaries.
+     */
+    validatePlan(steps: PlannedStep[]): Promise<{
+        valid: boolean;
+        violations: Array<{
+            step: string;
+            reason: string;
+        }>;
+    }>;
+    /**
+     * Ask the Envoy to validate whether user refinement feedback warrants a
+     * full replan. Cheap LLM call — no probe loop, no environment scanning.
+     * Always falls through to allow the replan if the call fails.
+     */
+    validateRefinementFeedback(params: {
+        feedback: string;
+        currentPlanSteps: Array<{
+            description: string;
+            action: string;
+            target: string;
+        }>;
+        artifactName: string;
+        environmentName: string;
+    }): Promise<{
+        mode: "replan" | "rejection" | "response";
+        message: string;
+    }>;
+}
+/**
+ * Adapts the EnvoyClient to the ServiceHealthChecker interface used by
+ * the Command Agent's pre-flight health check step.
+ *
+ * When a Envoy is registered for an environment, Command's health
+ * check actually reaches out to the Envoy instead of using the
+ * DefaultHealthChecker (which always returns healthy).
+ */
+export declare class EnvoyHealthChecker implements ServiceHealthChecker {
+    private envoys;
+    /**
+     * Register a Envoy for a specific environment.
+     * The serviceId format is "{operationId}/{environmentName}".
+     */
+    registerEnvoy(serviceId: string, client: EnvoyClient): void;
+    check(serviceId: string, _context: {
+        partitionId: string;
+        environmentName: string;
+    }): Promise<HealthCheckResult>;
+}
+//# sourceMappingURL=envoy-client.d.ts.map

package/dist/agent/envoy-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envoy-client.d.ts","sourceRoot":"","sources":["../../src/agent/envoy-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AAMtG,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,kBAAkB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,qEAAqE;IACrE,cAAc,EAAE,KAAK,CAAC;QACpB,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC;QAC1B,YAAY,EAAE,YAAY,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,OAAO,EAAE;QACP,gBAAgB,EAAE,MAAM,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAuFD;;;;;;;GAOG;AACH,qBAAa,WAAW;IAEpB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,SAAS;gBADT,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,MAAe;IAGpC,IAAI,GAAG,IAAI,MAAM,CAAyB;IAE1C;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAgBjD;;OAEG;IACG,MAAM,CAAC,WAAW,EAAE;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAc9B;;OAEG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAChC,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,cAAc,CAAC;QACrB,YAAY,EAAE,cAAc,CAAC;QAC7B,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAsB9B;;;;OAIG;IACG,WAAW,CAAC,MAAM,EAAE;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE;YACR,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE;gBACR,OAAO,EAAE,MAAM,CAAC;gBAChB,YAAY,EAAE,MAAM,EAAE,CAAC;gBACvB,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;gBAC1B,UAAU,EAAE,MAAM,CAAC;aACpB,CAAC;SACH,CAAC;QACF,WAAW,EAAE;YACX,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACnC,CAAC;QACF,SAAS,CAAC,EAAE;YACV,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACnC,CAAC;QACF,OAAO,EAAE,MAAM,CAAC;QAChB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,YAAY,EAAE,cAAc,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA2BxJ;;;;OAIG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAChC,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE;gBACR,OAAO,EAAE,MAAM,CAAC;gBAChB,YAAY,EAAE,MAAM,EAAE,CAAC;gBACvB,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;gBAC1B,UAAU,EAAE,MAAM,CAAC;aACpB,CAAC;SACH,CAAC;QACF,WAAW,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,cAAc,EAAE,KAAK,CAAC;YACpB,WAAW,EAAE,MAAM,CAAC;YACpB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,aAAa,CAAC;YAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC,CAAC;QACH,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,cAAc,CAAC;IAqB3B;;OAEG;IACG,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAc1H;;;;OAIG;IACG,0BAA0B,CAAC,MAAM,EAAE;QACvC,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,KAAK,CAAC;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjF,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAa5E;AAMD;;;;;;;GAOG;AACH,qBAAa,kBAAmB,YAAW,oBAAoB;IAC7D,OAAO,CAAC,MAAM,CAAkC;IAEhD;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI;IAIrD,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC,iBAAiB,CAAC;CA8D9B"}

package/dist/agent/envoy-client.js

@@ -0,0 +1,266 @@
+import { serverLog, serverWarn, serverError } from "../logger.js";
+const DEFAULT_RETRY = {
+    maxRetries: Number(process.env.SYNTH_ENVOY_MAX_RETRIES ?? 3),
+    baseDelayMs: 1000,
+    retryableStatuses: new Set([502, 503, 504]),
+};
+function isTransientError(err) {
+    if (!(err instanceof Error))
+        return false;
+    const msg = err.message;
+    return (msg.includes("ECONNREFUSED") ||
+        msg.includes("ECONNRESET") ||
+        msg.includes("fetch failed") ||
+        msg.includes("abort") ||
+        msg.includes("ETIMEDOUT") ||
+        msg.includes("network"));
+}
+async function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function fetchWithRetry(url, init, timeoutMs, opts = DEFAULT_RETRY) {
+    let lastError;
+    for (let attempt = 0; attempt <= opts.maxRetries; attempt++) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const response = await fetch(url, {
+                ...init,
+                signal: controller.signal,
+            });
+            // If retryable status code and we have retries left, retry
+            if (opts.retryableStatuses.has(response.status) && attempt < opts.maxRetries) {
+                const delay = opts.baseDelayMs * Math.pow(2, attempt);
+                console.log(`[envoy-client] Retryable HTTP ${response.status} on attempt ${attempt + 1}/${opts.maxRetries + 1}, retrying in ${delay}ms`);
+                serverWarn(`HTTP-RETRY`, { url, status: response.status, attempt: attempt + 1, maxAttempts: opts.maxRetries + 1, delayMs: delay });
+                await sleep(delay);
+                continue;
+            }
+            return response;
+        }
+        catch (err) {
+            lastError = err instanceof Error ? err : new Error(String(err));
+            if (isTransientError(err) && attempt < opts.maxRetries) {
+                const delay = opts.baseDelayMs * Math.pow(2, attempt);
+                console.log(`[envoy-client] Transient error on attempt ${attempt + 1}/${opts.maxRetries + 1}: ${lastError.message}, retrying in ${delay}ms`);
+                serverWarn(`TRANSIENT-RETRY`, { url, error: lastError.message, attempt: attempt + 1, maxAttempts: opts.maxRetries + 1, delayMs: delay });
+                await sleep(delay);
+                continue;
+            }
+            throw lastError;
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    throw lastError ?? new Error("Retry exhausted");
+}
+// ---------------------------------------------------------------------------
+// EnvoyClient — Command's interface to a remote Envoy
+// ---------------------------------------------------------------------------
+/**
+ * HTTP client for communicating with a Envoy agent.
+ *
+ * Command uses this to:
+ * 1. Check if the Envoy is healthy (pre-flight health check)
+ * 2. Delegate deployment execution to the Envoy
+ * 3. Query the Envoy's local state
+ */
+export class EnvoyClient {
+    baseUrl;
+    timeoutMs;
+    constructor(baseUrl, timeoutMs = 10_000) {
+        this.baseUrl = baseUrl;
+        this.timeoutMs = timeoutMs;
+    }
+    get url() { return this.baseUrl; }
+    /**
+     * Check Envoy health — used as the ServiceHealthChecker for the
+     * Command Agent's pre-flight health check step.
+     */
+    async checkHealth() {
+        serverLog("ENVOY-HEALTH-CHECK", { url: this.baseUrl });
+        const start = Date.now();
+        const response = await fetchWithRetry(`${this.baseUrl}/health`, {}, this.timeoutMs);
+        if (!response.ok) {
+            throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+        }
+        const result = (await response.json());
+        serverLog("ENVOY-HEALTH-OK", { url: this.baseUrl, status: result.status, ready: result.readiness.ready, durationMs: Date.now() - start });
+        return result;
+    }
+    /**
+     * Send a deployment instruction to the Envoy and wait for the result.
+     */
+    async deploy(instruction) {
+        const response = await fetchWithRetry(`${this.baseUrl}/deploy`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(instruction),
+        }, this.timeoutMs * 3);
+        return (await response.json());
+    }
+    /**
+     * Dispatch an approved plan to the Envoy for deterministic execution.
+     */
+    async executeApprovedPlan(params) {
+        serverLog("ENVOY-EXECUTE", { deploymentId: params.deploymentId, envoyUrl: this.baseUrl, artifact: params.artifactName, steps: params.plan?.steps?.length ?? 0 });
+        const execStart = Date.now();
+        const response = await fetchWithRetry(`${this.baseUrl}/execute`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(params),
+        }, this.timeoutMs * 6);
+        const execResult = (await response.json());
+        if (execResult.success) {
+            serverLog("ENVOY-EXECUTE-COMPLETE", { deploymentId: params.deploymentId, durationMs: Date.now() - execStart });
+        }
+        else {
+            serverLog("ENVOY-EXECUTE-FAILED", { deploymentId: params.deploymentId, failureReason: execResult.failureReason, durationMs: Date.now() - execStart });
+        }
+        return execResult;
+    }
+    /**
+     * Ask the Envoy to produce a deployment plan (read-only reasoning phase).
+     * Returns the plan and rollback plan; the server then submits them to
+     * POST /api/deployments/:id/plan to move the deployment to awaiting_approval.
+     */
+    async requestPlan(params) {
+        // Forward the LLM API key so the Envoy can use it if it started without one.
+        // Sent in the request body (not headers) over the trusted server↔envoy channel.
+        serverLog("ENVOY-PLAN-REQUEST", { deploymentId: params.deploymentId, envoyUrl: this.baseUrl, artifact: params.artifact.name, version: params.version, environment: params.environment.name });
+        const llmApiKey = process.env.SYNTH_LLM_API_KEY;
+        const planStart = Date.now();
+        const response = await fetchWithRetry(`${this.baseUrl}/plan`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(llmApiKey ? { ...params, llmApiKey } : params),
+        }, this.timeoutMs * 18);
+        if (!response.ok) {
+            const body = await response.text().catch(() => "");
+            serverLog("ENVOY-PLAN-FAILED", { deploymentId: params.deploymentId, status: response.status, durationMs: Date.now() - planStart });
+            throw new Error(`Envoy planning failed (HTTP ${response.status}): ${body}`);
+        }
+        const planResult = (await response.json());
+        serverLog("ENVOY-PLAN-RECEIVED", { deploymentId: params.deploymentId, steps: planResult.plan?.steps?.length ?? 0, blocked: planResult.blocked ?? false, durationMs: Date.now() - planStart });
+        return planResult;
+    }
+    /**
+     * Ask the Envoy to generate a rollback plan for a deployment that has
+     * already executed. Uses the execution record (what actually ran) rather
+     * than the forward plan, so the rollback is targeted to what actually changed.
+     */
+    async requestRollbackPlan(params) {
+        const llmApiKey = process.env.SYNTH_LLM_API_KEY;
+        const response = await fetchWithRetry(`${this.baseUrl}/rollback-plan`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(llmApiKey ? { ...params, llmApiKey } : params),
+        }, this.timeoutMs * 18);
+        if (!response.ok) {
+            const body = await response.text().catch(() => "");
+            throw new Error(`Envoy rollback planning failed (HTTP ${response.status}): ${body}`);
+        }
+        const data = (await response.json());
+        return data.rollbackPlan;
+    }
+    /**
+     * Validate a modified plan against the Envoy's security boundaries.
+     */
+    async validatePlan(steps) {
+        const response = await fetchWithRetry(`${this.baseUrl}/validate-plan`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ steps }),
+        }, this.timeoutMs);
+        return (await response.json());
+    }
+    /**
+     * Ask the Envoy to validate whether user refinement feedback warrants a
+     * full replan. Cheap LLM call — no probe loop, no environment scanning.
+     * Always falls through to allow the replan if the call fails.
+     */
+    async validateRefinementFeedback(params) {
+        const llmApiKey = process.env.SYNTH_LLM_API_KEY;
+        const response = await fetchWithRetry(`${this.baseUrl}/validate-refinement`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(llmApiKey ? { ...params, llmApiKey } : params),
+        }, this.timeoutMs * 3);
+        return (await response.json());
+    }
+}
+// ---------------------------------------------------------------------------
+// EnvoyHealthChecker — adapts EnvoyClient to ServiceHealthChecker
+// ---------------------------------------------------------------------------
+/**
+ * Adapts the EnvoyClient to the ServiceHealthChecker interface used by
+ * the Command Agent's pre-flight health check step.
+ *
+ * When a Envoy is registered for an environment, Command's health
+ * check actually reaches out to the Envoy instead of using the
+ * DefaultHealthChecker (which always returns healthy).
+ */
+export class EnvoyHealthChecker {
+    envoys = new Map();
+    /**
+     * Register a Envoy for a specific environment.
+     * The serviceId format is "{operationId}/{environmentName}".
+     */
+    registerEnvoy(serviceId, client) {
+        this.envoys.set(serviceId, client);
+    }
+    async check(serviceId, _context) {
+        const client = this.envoys.get(serviceId);
+        if (!client) {
+            // No Envoy registered for this service — assume healthy
+            // (same as DefaultHealthChecker behavior)
+            return { reachable: true, responseTimeMs: 0, error: null };
+        }
+        serverLog("HEALTH-CHECK", { serviceId, url: client.url });
+        const start = Date.now();
+        try {
+            const health = await client.checkHealth();
+            const responseTimeMs = Date.now() - start;
+            if (health.status === "healthy" && health.readiness.ready) {
+                serverLog("HEALTH-OK", { serviceId, responseTimeMs });
+                return { reachable: true, responseTimeMs, error: null };
+            }
+            serverWarn("HEALTH-DEGRADED", { serviceId, responseTimeMs, status: health.status, reason: health.readiness.reason });
+            return {
+                reachable: false,
+                responseTimeMs,
+                error: `Envoy reports ${health.status}: ${health.readiness.reason}`,
+            };
+        }
+        catch (err) {
+            const responseTimeMs = Date.now() - start;
+            const message = err instanceof Error ? err.message : String(err);
+            // Map fetch errors to recognizable categories for the Command Agent
+            if (message.includes("abort")) {
+                serverError("HEALTH-TIMEOUT", { serviceId, responseTimeMs });
+                return {
+                    reachable: false,
+                    responseTimeMs,
+                    error: `ETIMEDOUT: Envoy health check timed out after ${responseTimeMs}ms`,
+                };
+            }
+            if (message.includes("ECONNREFUSED") ||
+                message.includes("fetch failed")) {
+                serverError("HEALTH-REFUSED", { serviceId, responseTimeMs, url: client.url });
+                return {
+                    reachable: false,
+                    responseTimeMs,
+                    error: `ECONNREFUSED: Envoy at ${serviceId} is not responding`,
+                };
+            }
+            serverError("HEALTH-ERROR", { serviceId, responseTimeMs, error: message });
+            return {
+                reachable: false,
+                responseTimeMs,
+                error: `Envoy health check failed: ${message}`,
+            };
+        }
+    }
+}
+//# sourceMappingURL=envoy-client.js.map

package/dist/agent/envoy-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envoy-client.js","sourceRoot":"","sources":["../../src/agent/envoy-client.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AA0DlE,MAAM,aAAa,GAAiB;IAClC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,CAAC;IAC5D,WAAW,EAAE,IAAI;IACjB,iBAAiB,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;CAC5C,CAAC;AAEF,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;IACxB,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC1B,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QACrB,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,EAAU;IAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAW,EACX,IAAiB,EACjB,SAAiB,EACjB,OAAqB,aAAa;IAElC,IAAI,SAA4B,CAAC;IAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAEhE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,GAAG,IAAI;gBACP,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,2DAA2D;YAC3D,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACtD,OAAO,CAAC,GAAG,CAAC,iCAAiC,QAAQ,CAAC,MAAM,eAAe,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC;gBACzI,UAAU,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnI,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAEhE,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBACvD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACtD,OAAO,CAAC,GAAG,CAAC,6CAA6C,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,KAAK,SAAS,CAAC,OAAO,iBAAiB,KAAK,IAAI,CAAC,CAAC;gBAC7I,UAAU,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzI,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YAED,MAAM,SAAS,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IAEZ;IACA;IAFV,YACU,OAAe,EACf,YAAoB,MAAM;QAD1B,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAiB;IACjC,CAAC;IAEJ,IAAI,GAAG,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE1C;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,SAAS,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,GAAG,IAAI,CAAC,OAAO,SAAS,EACxB,EAAE,EACF,IAAI,CAAC,SAAS,CACf,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;QAC9D,SAAS,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC1I,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,WAUZ;QACC,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,GAAG,IAAI,CAAC,OAAO,SAAS,EACxB;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;SAClC,EACD,IAAI,CAAC,SAAS,GAAG,CAAC,CACnB,CAAC;QAEF,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,MASzB;QACC,SAAS,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QACjK,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,GAAG,IAAI,CAAC,OAAO,UAAU,EACzB;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7B,EACD,IAAI,CAAC,SAAS,GAAG,CAAC,CACnB,CAAC;QAEF,MAAM,UAAU,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;QAChE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,SAAS,CAAC,wBAAwB,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACjH,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,sBAAsB,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,MA2BjB;QACC,6EAA6E;QAC7E,gFAAgF;QAChF,SAAS,CAAC,oBAAoB,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9L,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,GAAG,IAAI,CAAC,OAAO,OAAO,EACtB;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;SACpE,EACD,IAAI,CAAC,SAAS,GAAG,EAAE,CACpB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,SAAS,CAAC,mBAAmB,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;YACnI,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgJ,CAAC;QAC1L,SAAS,CAAC,qBAAqB,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAC9L,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,MAwBzB;QACC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,GAAG,IAAI,CAAC,OAAO,gBAAgB,EAC/B;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;SACpE,EACD,IAAI,CAAC,SAAS,GAAG,EAAE,CACpB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAC;QACzE,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,KAAoB;QACrC,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,GAAG,IAAI,CAAC,OAAO,gBAAgB,EAC/B;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,EACD,IAAI,CAAC,SAAS,CACf,CAAC;QAEF,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4E,CAAC;IAC5G,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,0BAA0B,CAAC,MAKhC;QACC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,GAAG,IAAI,CAAC,OAAO,sBAAsB,EACrC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;SACpE,EACD,IAAI,CAAC,SAAS,GAAG,CAAC,CACnB,CAAC;QACF,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmE,CAAC;IACnG,CAAC;CACF;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACrB,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEhD;;;OAGG;IACH,aAAa,CAAC,SAAiB,EAAE,MAAmB;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,KAAK,CACT,SAAiB,EACjB,QAA0D;QAE1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,wDAAwD;YACxD,0CAA0C;YAC1C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC7D,CAAC;QAED,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAE1C,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAC1D,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;gBACtD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC1D,CAAC;YAED,UAAU,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YACrH,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,cAAc;gBACd,KAAK,EAAE,iBAAiB,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE;aACpE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAC1C,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEnD,oEAAoE;YACpE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,WAAW,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC7D,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,cAAc;oBACd,KAAK,EAAE,iDAAiD,cAAc,IAAI;iBAC3E,CAAC;YACJ,CAAC;YAED,IACE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAChC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAChC,CAAC;gBACD,WAAW,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC9E,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,cAAc;oBACd,KAAK,EAAE,0BAA0B,SAAS,oBAAoB;iBAC/D,CAAC;YACJ,CAAC;YAED,WAAW,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3E,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,cAAc;gBACd,KAAK,EAAE,8BAA8B,OAAO,EAAE;aAC/C,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/agent/envoy-registry.d.ts

@@ -0,0 +1,102 @@
+import type { EnvoyHealthResponse } from "./envoy-client.js";
+import type { PersistentEnvoyRegistryStore } from "@synth-deploy/core";
+export interface EnvoyRegistration {
+    id: string;
+    name: string;
+    url: string;
+    /** Shared secret for authenticating requests between Command and this Envoy */
+    token: string;
+    /** Environments this Envoy is assigned to (empty = available for any) */
+    assignedEnvironments: string[];
+    /** Partitions this Envoy is assigned to */
+    assignedPartitions: string[];
+    registeredAt: string;
+    lastHealthCheck: string | null;
+    lastHealthStatus: "healthy" | "degraded" | "unreachable" | null;
+    /** Cached from last successful health probe */
+    cachedHostname: string | null;
+    cachedOs: string | null;
+    cachedSummary: EnvoyHealthResponse["summary"] | null;
+    cachedReadiness: EnvoyHealthResponse["readiness"] | null;
+}
+export interface EnvoyRegistryEntry extends EnvoyRegistration {
+    health: "OK" | "Degraded" | "Unreachable";
+    hostname: string | null;
+    os: string | null;
+    lastSeen: string | null;
+    summary: EnvoyHealthResponse["summary"] | null;
+    readiness: EnvoyHealthResponse["readiness"] | null;
+}
+export declare class EnvoyRegistry {
+    private store?;
+    constructor(store?: PersistentEnvoyRegistryStore | undefined);
+    /**
+     * Register a new Envoy. Returns the registration with a generated token.
+     */
+    register(params: {
+        name: string;
+        url: string;
+        assignedEnvironments?: string[];
+        assignedPartitions?: string[];
+    }): EnvoyRegistration;
+    /**
+     * Deregister an Envoy by ID.
+     */
+    deregister(id: string): boolean;
+    /**
+     * List all registered Envoys.
+     */
+    list(): EnvoyRegistration[];
+    /**
+     * Update an Envoy's assignment or name.
+     */
+    update(id: string, updates: {
+        name?: string;
+        url?: string;
+        assignedEnvironments?: string[];
+        assignedPartitions?: string[];
+    }): EnvoyRegistration | undefined;
+    /**
+     * Ensure an envoy at `url` is registered with a specific `token`.
+     * If already registered, updates its token. If not, creates a new entry.
+     * Used to bootstrap the default envoy from environment variables (SYNTH_ENVOY_TOKEN).
+     */
+    ensureRegisteredWithToken(params: {
+        name: string;
+        url: string;
+    }, token: string): EnvoyRegistration;
+    /**
+     * Rotate the token for an Envoy. Returns the new token.
+     */
+    rotateToken(id: string): string | undefined;
+    /**
+     * Validate a token against a registered Envoy.
+     */
+    validateToken(token: string): EnvoyRegistration | undefined;
+    /**
+     * Update health status for an Envoy (called after probing).
+     */
+    updateHealth(id: string, status: "healthy" | "degraded" | "unreachable"): void;
+    /**
+     * Find the best Envoy for a given environment.
+     * Priority: assigned + healthy > assigned + degraded > unassigned + healthy > fallback
+     */
+    findForEnvironment(environmentName: string): EnvoyRegistration | undefined;
+    /**
+     * Return cached registry entry without probing (instant).
+     */
+    get(id: string): EnvoyRegistryEntry | undefined;
+    /**
+     * Return all cached registry entries without probing (instant).
+     */
+    listEntries(): EnvoyRegistryEntry[];
+    /**
+     * Probe an Envoy's health and update its registry entry.
+     */
+    probe(id: string): Promise<EnvoyRegistryEntry | undefined>;
+    /**
+     * Probe all registered Envoys and return their status.
+     */
+    probeAll(): Promise<EnvoyRegistryEntry[]>;
+}
+//# sourceMappingURL=envoy-registry.d.ts.map

package/dist/agent/envoy-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envoy-registry.d.ts","sourceRoot":"","sources":["../../src/agent/envoy-registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,4BAA4B,EAA8B,MAAM,oBAAoB,CAAC;AAMnG,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,2CAA2C;IAC3C,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gBAAgB,EAAE,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,IAAI,CAAC;IAChE,+CAA+C;IAC/C,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,mBAAmB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACrD,eAAe,EAAE,mBAAmB,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,MAAM,EAAE,IAAI,GAAG,UAAU,GAAG,aAAa,CAAC;IAC1C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IAC/C,SAAS,EAAE,mBAAmB,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;CACpD;AA8CD,qBAAa,aAAa;IACZ,OAAO,CAAC,KAAK,CAAC;gBAAN,KAAK,CAAC,EAAE,4BAA4B,YAAA;IAExD;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;QAChC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC/B,GAAG,iBAAiB;IAwBrB;;OAEG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAO/B;;OAEG;IACH,IAAI,IAAI,iBAAiB,EAAE;IAO3B;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;QAChC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC/B,GAAG,iBAAiB,GAAG,SAAS;IAejC;;;;OAIG;IACH,yBAAyB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,KAAK,EAAE,MAAM,GAAG,iBAAiB;IA2BlG;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAU3C;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAM3D;;OAEG;IACH,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,IAAI;IAI9E;;;OAGG;IACH,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAkC1E;;OAEG;IACH,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAqB/C;;OAEG;IACH,WAAW,IAAI,kBAAkB,EAAE;IAmBnC;;OAEG;IACG,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAgEhE;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;CAQhD"}