@usenaive-sdk/cli 0.12.5 → 0.13.1

package/dist/commands/up.d.ts

@@ -1,3 +1,153 @@
 import { Command } from "commander";
+import { type NextStep } from "../output.js";
+/** What the API reports about the brains `company.brains` declared. */
+interface BrainsResult {
+    declared_in?: string | null;
+    created?: Array<{
+        name: string;
+    }>;
+    converged?: Array<{
+        name: string;
+    }>;
+    default?: {
+        name?: string | null;
+        changed?: boolean;
+    };
+    retained_undeclared?: string[];
+    /**
+     * Declared brain policy with no column to land in, per brain.
+     * `brain_knowledge_bases` has columns for name, is_default, scope, status and
+     * provider ids and nothing else, so `retention`, `partitions`, `writes`,
+     * `recall`, `lanes`, `visibility` and `bounds` are accepted and not stored.
+     */
+    unpersisted?: Record<string, string[]>;
+    /** The server's own prose for the same, plus the retained-undeclared note. */
+    notes?: string[];
+}
+/**
+ * The brain half of the report, or undefined when the config declared none.
+ *
+ * Exported for the same reason it exists: `naive up` printed `applied: true` and
+ * said NOTHING about brains, so a config that declared two of them looked
+ * identical to a config that declared none. `--plan` showed them (it prints the
+ * whole plan); apply did not. A provisioned thing that is not reported is the
+ * same silence as an unprovisioned one, one level up.
+ *
+ * 🔴 AND `unpersisted` IS PART OF THE REPORT, NOT AN EXTRA. The apply path
+ * computed the accept-and-drop list and this projection threw it away, so
+ * `naive up --plan` told the user which declared brain keys have no column and
+ * plain `naive up` — the command people actually run — did not. That is the same
+ * defect one level down: `packages/api/src/services/deployment-brains.ts`'s own
+ * header calls accept-and-drop "the exact defect this file exists to remove", and
+ * a report only the dry run prints is a report most operators never see.
+ */
+export declare function brainReport(brains: BrainsResult | undefined): {
+    declared_in: string | null;
+    created: string[];
+    converged: string[];
+    default: string | null;
+    retained: string[];
+    unpersisted?: Record<string, string[]>;
+    notes?: string[];
+} | undefined;
+/** What the plan reports per declared team, whichever runtime it asked for. */
+interface TeamPlanEntry {
+    name: string;
+    runtime: string;
+    roles?: string[];
+    lead_role?: string;
+    /** Role → runtime, present only for a MIXED team. See `role_runtimes` on the API. */
+    role_runtimes?: Record<string, string>;
+    placement?: {
+        status: string;
+        code?: string;
+        message?: string;
+    };
+    /** Keys this team declared that NOTHING on the control plane reads. */
+    unconsumed?: string[];
+}
+/**
+ * The per-team accept-and-drop warning, one line per team that declared any.
+ *
+ * The data has been on the wire the whole time (`plan.teams[].unconsumed`,
+ * computed by `unconsumedTeamKeys` in packages/api) and `naive up` printed none
+ * of it — `team({ governance: {…} })` applied green and enforced nothing, with
+ * nothing anywhere for the author to notice. Printed on the PLAN and on the
+ * APPLY, because a report only the dry run shows is a report most operators
+ * never see.
+ */
+export declare function unconsumedWarnings(teams: readonly TeamPlanEntry[]): string[];
+/**
+ * ONE deprecation line when the config still uses the legacy ECS surface —
+ * `runtime.pool()` declarations, an agent-level `runtime: "<pool>"` string, or
+ * `systems:`. All three keep working indefinitely; the line names what was
+ * found and where new configs should author instead.
+ */
+export declare function legacyDeprecationNotice(config: Record<string, unknown>): string | null;
+/**
+ * ONE rename line when the config declares `agents:`. Separate from the legacy
+ * line above on purpose: `runtime.pool()` / `systems:` are a deprecated
+ * SURFACE, while `agents:` is a deprecated SPELLING — the block compiles to
+ * byte-for-byte what `kits:` compiles to, so the honest notice is "rename",
+ * not "migrate". A notice, never a refusal, on both entrypoints.
+ */
+export declare function agentsRenameNotice(config: Record<string, unknown>): string | null;
+/**
+ * The operator credential the DURABLE RUNTIME issued, read from the ENVIRONMENT.
+ *
+ * Never from `naive.config.ts`, and that is the whole point rather than a style
+ * choice. The config is committed, so a credential in it is a credential in git —
+ * and, more importantly, the config is the one thing that must not by itself be
+ * able to change where a tenant runs. Pointing a tenant at the durable runtime
+ * overwrites its `sidecar_url` and `container_auth_token` and nulls its
+ * `instance_id`, none of which is stashed anywhere. Requiring a second, separate
+ * act means an edit alone can never do it.
+ *
+ * `NAIVE_DURABLE_CREDENTIAL_<TEAM>` names one team; `NAIVE_DURABLE_CREDENTIAL`
+ * covers them all. Neither is ever printed, and the API never echoes it back.
+ */
+export declare function durableCredentialEnvVar(team: string): string;
+/**
+ * The recovery for ONE refused team — a command that EXISTS, or none.
+ *
+ * 🔴 `naive runtime migrate` IS NOT A COMMAND, AND THIS USED TO PRINT IT.
+ * Every refusal here used to emit
+ * `naive runtime migrate --tenant … --to durable --credential-from <file>`.
+ * Measured on the built CLI: `naive runtime migrate --tenant <id> --to hermes`
+ * answers
+ * `{"code":"cli_outdated","message":"Unknown command 'runtime'. Your naive CLI
+ * is v0.12.4; this command may exist in a newer version."}` — and it exists in
+ * NO version: `packages/cli/src/index.ts` registers no `runtime` group at all.
+ * So an operator whose apply was refused was handed a command that tells them to
+ * upgrade, forever. A next_step that cannot be run is worse than none, because it
+ * ends the search.
+ *
+ * The two cases are genuinely different and are answered differently:
+ *
+ *   · `runtime_credential_required` — there IS a procedure, it works today, and
+ *     it is the one this command already implements: put the operator credential
+ *     the durable runtime issued in the environment and re-run. Never in
+ *     `naive.config.ts`, which is committed.
+ *   · everything else (`runtime_migration_requires_explicit_opt_in`,
+ *     `runtime_claim_in_flight`, `runtime_placement_lost_race`,
+ *     `runtime_not_configured`, `runtime_state_unknown`) — there is NO self-serve
+ *     command on this build. Moving an existing tenant between runtimes
+ *     overwrites `sidecar_url` and `container_auth_token` and nulls `instance_id`
+ *     with nothing stashed, so the control plane refuses it and no client can do
+ *     it either. Say that, and print the server's own message, rather than
+ *     inventing a command to carry the blame.
+ *
+ * The API writes the same vapour into `details.migrate_command`
+ * (packages/api/src/services/placement.ts MIGRATE_COMMAND). That string is not
+ * this package's to change and is reported as a follow-up; this function is why
+ * `naive up` no longer repeats it.
+ */
+export declare function refusalNextStep(t: {
+    name: string;
+    placement?: {
+        code?: string;
+    };
+}): NextStep | null;
 export declare const upCmd: Command;
 export declare const downCmd: Command;
+export {};