@wopr-network/platform-core 1.26.0 → 1.27.1

package/dist/db/schema/index.d.ts

@@ -64,6 +64,7 @@ export * from "./tenant-capability-settings.js";
 export * from "./tenant-customers.js";
 export * from "./tenant-model-selection.js";
 export * from "./tenant-status.js";
+export * from "./tenant-update-configs.js";
 export * from "./tenants.js";
 export * from "./user-roles.js";
 export * from "./vps-subscriptions.js";

package/dist/db/schema/index.js

@@ -64,6 +64,7 @@ export * from "./tenant-capability-settings.js";
 export * from "./tenant-customers.js";
 export * from "./tenant-model-selection.js";
 export * from "./tenant-status.js";
+export * from "./tenant-update-configs.js";
 export * from "./tenants.js";
 export * from "./user-roles.js";
 export * from "./vps-subscriptions.js";

package/dist/db/schema/tenant-update-configs.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Per-tenant update configuration — controls whether a tenant's bots
+ * are updated automatically or require manual intervention.
+ */
+export declare const tenantUpdateConfigs: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "tenant_update_configs";
+    schema: undefined;
+    columns: {
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "tenant_update_configs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        mode: import("drizzle-orm/pg-core").PgColumn<{
+            name: "mode";
+            tableName: "tenant_update_configs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        preferredHourUtc: import("drizzle-orm/pg-core").PgColumn<{
+            name: "preferred_hour_utc";
+            tableName: "tenant_update_configs";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "tenant_update_configs";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;

package/dist/db/schema/tenant-update-configs.js

@@ -0,0 +1,15 @@
+import { bigint, integer, pgTable, text } from "drizzle-orm/pg-core";
+/**
+ * Per-tenant update configuration — controls whether a tenant's bots
+ * are updated automatically or require manual intervention.
+ */
+export const tenantUpdateConfigs = pgTable("tenant_update_configs", {
+    /** Owning tenant (one config per tenant) */
+    tenantId: text("tenant_id").primaryKey(),
+    /** Update mode: 'auto' for automatic updates, 'manual' for opt-in */
+    mode: text("mode").notNull().default("manual"),
+    /** Preferred hour (0-23 UTC) for automatic updates */
+    preferredHourUtc: integer("preferred_hour_utc").notNull().default(3),
+    /** Epoch ms of last config change */
+    updatedAt: bigint("updated_at", { mode: "number" }).notNull(),
+});

package/dist/fleet/__tests__/tenant-update-config-repository.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/fleet/__tests__/tenant-update-config-repository.test.js

@@ -0,0 +1,55 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { beginTestTransaction, createTestDb, endTestTransaction, rollbackTestTransaction } from "../../test/db.js";
+import { DrizzleTenantUpdateConfigRepository } from "../drizzle-tenant-update-config-repository.js";
+describe("DrizzleTenantUpdateConfigRepository", () => {
+    let db;
+    let pool;
+    let repo;
+    beforeAll(async () => {
+        ({ db, pool } = await createTestDb());
+        await beginTestTransaction(pool);
+    });
+    afterAll(async () => {
+        await endTestTransaction(pool);
+        await pool.close();
+    });
+    beforeEach(async () => {
+        await rollbackTestTransaction(pool);
+        repo = new DrizzleTenantUpdateConfigRepository(db);
+    });
+    it("get returns null for unknown tenant", async () => {
+        expect(await repo.get("nonexistent")).toBeNull();
+    });
+    it("upsert creates a new config", async () => {
+        await repo.upsert("tenant-1", { mode: "auto", preferredHourUtc: 5 });
+        const config = await repo.get("tenant-1");
+        expect(config).not.toBeNull();
+        expect(config?.tenantId).toBe("tenant-1");
+        expect(config?.mode).toBe("auto");
+        expect(config?.preferredHourUtc).toBe(5);
+        expect(config?.updatedAt).toBeGreaterThan(0);
+    });
+    it("upsert updates an existing config", async () => {
+        await repo.upsert("tenant-1", { mode: "auto", preferredHourUtc: 5 });
+        const before = await repo.get("tenant-1");
+        await repo.upsert("tenant-1", { mode: "manual", preferredHourUtc: 12 });
+        const after = await repo.get("tenant-1");
+        expect(after?.mode).toBe("manual");
+        expect(after?.preferredHourUtc).toBe(12);
+        expect(after?.updatedAt).toBeGreaterThanOrEqual(before?.updatedAt ?? 0);
+    });
+    it("listAutoEnabled returns only auto-mode tenants", async () => {
+        await repo.upsert("tenant-auto-1", { mode: "auto", preferredHourUtc: 3 });
+        await repo.upsert("tenant-auto-2", { mode: "auto", preferredHourUtc: 8 });
+        await repo.upsert("tenant-manual", { mode: "manual", preferredHourUtc: 0 });
+        const autoConfigs = await repo.listAutoEnabled();
+        expect(autoConfigs).toHaveLength(2);
+        expect(autoConfigs.every((c) => c.mode === "auto")).toBe(true);
+        expect(autoConfigs.map((c) => c.tenantId).sort()).toEqual(["tenant-auto-1", "tenant-auto-2"]);
+    });
+    it("listAutoEnabled returns empty array when none enabled", async () => {
+        await repo.upsert("tenant-manual", { mode: "manual", preferredHourUtc: 0 });
+        const autoConfigs = await repo.listAutoEnabled();
+        expect(autoConfigs).toEqual([]);
+    });
+});

package/dist/fleet/drizzle-tenant-update-config-repository.d.ts

@@ -0,0 +1,10 @@
+import type { DrizzleDb } from "../db/index.js";
+import type { ITenantUpdateConfigRepository, TenantUpdateConfig } from "./tenant-update-config-repository.js";
+/** Drizzle-backed implementation of ITenantUpdateConfigRepository. */
+export declare class DrizzleTenantUpdateConfigRepository implements ITenantUpdateConfigRepository {
+    private readonly db;
+    constructor(db: DrizzleDb);
+    get(tenantId: string): Promise<TenantUpdateConfig | null>;
+    upsert(tenantId: string, config: Omit<TenantUpdateConfig, "tenantId" | "updatedAt">): Promise<void>;
+    listAutoEnabled(): Promise<TenantUpdateConfig[]>;
+}

package/dist/fleet/drizzle-tenant-update-config-repository.js

@@ -0,0 +1,44 @@
+import { eq } from "drizzle-orm";
+import { tenantUpdateConfigs } from "../db/schema/index.js";
+/** Drizzle-backed implementation of ITenantUpdateConfigRepository. */
+export class DrizzleTenantUpdateConfigRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async get(tenantId) {
+        const rows = await this.db.select().from(tenantUpdateConfigs).where(eq(tenantUpdateConfigs.tenantId, tenantId));
+        return rows[0] ? toConfig(rows[0]) : null;
+    }
+    async upsert(tenantId, config) {
+        const now = Date.now();
+        await this.db
+            .insert(tenantUpdateConfigs)
+            .values({
+            tenantId,
+            mode: config.mode,
+            preferredHourUtc: config.preferredHourUtc,
+            updatedAt: now,
+        })
+            .onConflictDoUpdate({
+            target: tenantUpdateConfigs.tenantId,
+            set: {
+                mode: config.mode,
+                preferredHourUtc: config.preferredHourUtc,
+                updatedAt: now,
+            },
+        });
+    }
+    async listAutoEnabled() {
+        const rows = await this.db.select().from(tenantUpdateConfigs).where(eq(tenantUpdateConfigs.mode, "auto"));
+        return rows.map(toConfig);
+    }
+}
+function toConfig(row) {
+    return {
+        tenantId: row.tenantId,
+        mode: row.mode,
+        preferredHourUtc: row.preferredHourUtc,
+        updatedAt: row.updatedAt,
+    };
+}

package/dist/fleet/fleet-event-emitter.d.ts

@@ -1,5 +1,5 @@
 import type { IFleetEventRepository } from "./fleet-event-repository.js";
-export type BotEventType = "bot.started" | "bot.stopped" | "bot.created" | "bot.removed" | "bot.restarted";
+export type BotEventType = "bot.started" | "bot.stopped" | "bot.created" | "bot.removed" | "bot.restarted" | "bot.updated" | "bot.update_failed";
 export type NodeEventType = "node.provisioned" | "node.registered" | "node.draining" | "node.drained" | "node.deprovisioned" | "node.heartbeat_lost" | "node.returned";
 export type FleetEventType = BotEventType | NodeEventType;
 export interface BotFleetEvent {

package/dist/fleet/index.d.ts

@@ -1,7 +1,9 @@
+export * from "./drizzle-tenant-update-config-repository.js";
 export * from "./init-fleet-updater.js";
 export * from "./repository-types.js";
 export * from "./rollout-orchestrator.js";
 export * from "./rollout-strategy.js";
 export * from "./services.js";
+export * from "./tenant-update-config-repository.js";
 export * from "./types.js";
 export * from "./volume-snapshot-manager.js";

package/dist/fleet/index.js

@@ -1,7 +1,9 @@
+export * from "./drizzle-tenant-update-config-repository.js";
 export * from "./init-fleet-updater.js";
 export * from "./repository-types.js";
 export * from "./rollout-orchestrator.js";
 export * from "./rollout-strategy.js";
 export * from "./services.js";
+export * from "./tenant-update-config-repository.js";
 export * from "./types.js";
 export * from "./volume-snapshot-manager.js";

package/dist/fleet/init-fleet-updater.d.ts

@@ -12,11 +12,13 @@
  */
 import type Docker from "dockerode";
 import type { IBotProfileRepository } from "./bot-profile-repository.js";
+import type { FleetEventEmitter } from "./fleet-event-emitter.js";
 import type { FleetManager } from "./fleet-manager.js";
 import { ImagePoller } from "./image-poller.js";
 import type { IProfileStore } from "./profile-store.js";
 import { RolloutOrchestrator, type RolloutResult } from "./rollout-orchestrator.js";
 import { type RollingWaveOptions } from "./rollout-strategy.js";
+import type { ITenantUpdateConfigRepository } from "./tenant-update-config-repository.js";
 import { ContainerUpdater } from "./updater.js";
 import { VolumeSnapshotManager } from "./volume-snapshot-manager.js";
 export interface FleetUpdaterConfig {
@@ -34,6 +36,10 @@ export interface FleetUpdaterConfig {
     }) => void;
     /** Called when a rollout completes */
     onRolloutComplete?: (result: RolloutResult) => void;
+    /** Optional per-tenant update config repository. When provided, tenants with mode=manual are excluded. */
+    configRepo?: ITenantUpdateConfigRepository;
+    /** Optional fleet event emitter. When provided, bot.updated / bot.update_failed events are emitted. */
+    eventEmitter?: FleetEventEmitter;
 }
 export interface FleetUpdaterHandle {
     poller: ImagePoller;

package/dist/fleet/init-fleet-updater.js

@@ -29,7 +29,7 @@ import { VolumeSnapshotManager } from "./volume-snapshot-manager.js";
  * @param config - Optional pipeline configuration
  */
 export function initFleetUpdater(docker, fleet, profileStore, profileRepo, config = {}) {
-    const { strategy: strategyType = "rolling-wave", strategyOptions, snapshotDir = "/data/fleet/snapshots", onBotUpdated, onRolloutComplete, } = config;
+    const { strategy: strategyType = "rolling-wave", strategyOptions, snapshotDir = "/data/fleet/snapshots", onBotUpdated, onRolloutComplete, configRepo, eventEmitter, } = config;
     const poller = new ImagePoller(docker, profileStore);
     const updater = new ContainerUpdater(docker, profileStore, fleet, poller);
     const snapshotManager = new VolumeSnapshotManager(docker, snapshotDir);
@@ -40,10 +40,35 @@ export function initFleetUpdater(docker, fleet, profileStore, profileRepo, confi
         strategy,
         getUpdatableProfiles: async () => {
             const profiles = await profileRepo.list();
-            return profiles.filter((p) => p.updatePolicy !== "manual");
+            const nonManualPolicy = profiles.filter((p) => p.updatePolicy !== "manual");
+            if (!configRepo)
+                return nonManualPolicy;
+            // Filter out tenants whose per-tenant config is set to manual
+            const results = await Promise.all(nonManualPolicy.map(async (p) => {
+                const tenantCfg = await configRepo.get(p.tenantId);
+                // If tenant has an explicit config with mode=manual, exclude
+                if (tenantCfg && tenantCfg.mode === "manual")
+                    return null;
+                return p;
+            }));
+            return results.filter((p) => p !== null);
+        },
+        onBotUpdated: (result) => {
+            // Emit fleet events if emitter is provided
+            if (eventEmitter) {
+                eventEmitter.emit({
+                    type: result.success ? "bot.updated" : "bot.update_failed",
+                    botId: result.botId,
+                    tenantId: "",
+                    timestamp: new Date().toISOString(),
+                });
+            }
+            // Chain user-provided callback
+            onBotUpdated?.(result);
+        },
+        onRolloutComplete: (result) => {
+            onRolloutComplete?.(result);
         },
-        onBotUpdated,
-        onRolloutComplete,
     });
     // Wire the detection → orchestration pipeline.
     // Any digest change triggers a fleet-wide rollout because the managed image

package/dist/fleet/services.d.ts

@@ -42,6 +42,7 @@ import { OrphanCleaner } from "./orphan-cleaner.js";
 import { RecoveryOrchestrator } from "./recovery-orchestrator.js";
 import type { IRecoveryRepository } from "./recovery-repository.js";
 import type { IRegistrationTokenRepository } from "./registration-token-store.js";
+import type { ITenantUpdateConfigRepository } from "./tenant-update-config-repository.js";
 import type { IVpsRepository } from "./vps-repository.js";
 export declare function getPool(): Pool;
 export declare function getDb(): DrizzleDb;
@@ -71,6 +72,7 @@ export declare function getMigrationOrchestrator(): MigrationOrchestrator;
 export declare function getNodeDrainer(): NodeDrainer;
 export declare function getFleetEventEmitter(): FleetEventEmitter;
 export declare function getFleetEventRepo(): IFleetEventRepository;
+export declare function getTenantUpdateConfigRepo(): ITenantUpdateConfigRepository;
 export declare function getHeartbeatWatchdog(): HeartbeatWatchdog;
 export declare function getInferenceWatchdog(): InferenceWatchdog;
 export declare function getDOClient(): DOClient;

package/dist/fleet/services.js

@@ -37,6 +37,7 @@ import { DrizzleBotProfileRepository } from "./drizzle-bot-profile-repository.js
 import { DrizzleFleetEventRepository } from "./drizzle-fleet-event-repository.js";
 import { DrizzleNodeRepository } from "./drizzle-node-repository.js";
 import { DrizzleRecoveryRepository } from "./drizzle-recovery-repository.js";
+import { DrizzleTenantUpdateConfigRepository } from "./drizzle-tenant-update-config-repository.js";
 import { FleetEventEmitter } from "./fleet-event-emitter.js";
 import { DrizzleGpuAllocationRepository } from "./gpu-allocation-repository.js";
 import { DrizzleGpuConfigurationRepository } from "./gpu-configuration-repository.js";
@@ -95,6 +96,8 @@ let _inferenceWatchdog = null;
 let _fleetEventEmitter = null;
 // Fleet event repository
 let _fleetEventRepo = null;
+// Tenant update config
+let _tenantUpdateConfigRepo = null;
 // Infrastructure
 let _doClient = null;
 let _nodeProvider = null;
@@ -317,6 +320,12 @@ export function getFleetEventRepo() {
     }
     return _fleetEventRepo;
 }
+export function getTenantUpdateConfigRepo() {
+    if (!_tenantUpdateConfigRepo) {
+        _tenantUpdateConfigRepo = new DrizzleTenantUpdateConfigRepository(getDb());
+    }
+    return _tenantUpdateConfigRepo;
+}
 // ---------------------------------------------------------------------------
 // HeartbeatWatchdog
 // ---------------------------------------------------------------------------
@@ -694,6 +703,7 @@ export function _resetForTest() {
     _inferenceWatchdog = null;
     _fleetEventRepo = null;
     _fleetEventEmitter = null;
+    _tenantUpdateConfigRepo = null;
     _doClient = null;
     _nodeProvider = null;
     _nodeProvisioner = null;

package/dist/fleet/tenant-update-config-repository.d.ts

@@ -0,0 +1,11 @@
+export interface TenantUpdateConfig {
+    tenantId: string;
+    mode: "auto" | "manual";
+    preferredHourUtc: number;
+    updatedAt: number;
+}
+export interface ITenantUpdateConfigRepository {
+    get(tenantId: string): Promise<TenantUpdateConfig | null>;
+    upsert(tenantId: string, config: Omit<TenantUpdateConfig, "tenantId" | "updatedAt">): Promise<void>;
+    listAutoEnabled(): Promise<TenantUpdateConfig[]>;
+}

package/dist/fleet/tenant-update-config-repository.js

@@ -0,0 +1 @@
+export {};

package/dist/trpc/fleet-update-config-router.d.ts

@@ -0,0 +1,24 @@
+import type { ITenantUpdateConfigRepository } from "../fleet/tenant-update-config-repository.js";
+export declare function createFleetUpdateConfigRouter(getConfigRepo: () => ITenantUpdateConfigRepository): import("@trpc/server").TRPCBuiltRouter<{
+    ctx: import("./init.js").TRPCContext;
+    meta: object;
+    errorShape: import("@trpc/server").TRPCDefaultErrorShape;
+    transformer: false;
+}, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+    getUpdateConfig: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+            tenantId: string;
+        };
+        output: import("../fleet/tenant-update-config-repository.js").TenantUpdateConfig | null;
+        meta: object;
+    }>;
+    setUpdateConfig: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            tenantId: string;
+            mode: "manual" | "auto";
+            preferredHourUtc?: number | undefined;
+        };
+        output: void;
+        meta: object;
+    }>;
+}>>;

package/dist/trpc/fleet-update-config-router.js

@@ -0,0 +1,26 @@
+import { z } from "zod";
+import { logger } from "../config/logger.js";
+import { protectedProcedure, router } from "./init.js";
+export function createFleetUpdateConfigRouter(getConfigRepo) {
+    return router({
+        getUpdateConfig: protectedProcedure.input(z.object({ tenantId: z.string().min(1) })).query(async ({ input }) => {
+            return getConfigRepo().get(input.tenantId);
+        }),
+        setUpdateConfig: protectedProcedure
+            .input(z.object({
+            tenantId: z.string().min(1),
+            mode: z.enum(["auto", "manual"]),
+            preferredHourUtc: z.number().int().min(0).max(23).optional(),
+        }))
+            .mutation(async ({ input }) => {
+            await getConfigRepo().upsert(input.tenantId, {
+                mode: input.mode,
+                preferredHourUtc: input.preferredHourUtc ?? 3,
+            });
+            logger.info("Tenant update config changed", {
+                tenantId: input.tenantId,
+                mode: input.mode,
+            });
+        }),
+    });
+}

package/dist/trpc/index.d.ts

@@ -1 +1,2 @@
+export { createFleetUpdateConfigRouter } from "./fleet-update-config-router.js";
 export { adminProcedure, createCallerFactory, orgAdminProcedure, orgMemberProcedure, protectedProcedure, publicProcedure, router, setTrpcOrgMemberRepo, type TRPCContext, tenantProcedure, } from "./init.js";

package/dist/trpc/index.js

@@ -1 +1,2 @@
+export { createFleetUpdateConfigRouter } from "./fleet-update-config-router.js";
 export { adminProcedure, createCallerFactory, orgAdminProcedure, orgMemberProcedure, protectedProcedure, publicProcedure, router, setTrpcOrgMemberRepo, tenantProcedure, } from "./init.js";

package/drizzle/migrations/0009_tenant_update_configs.sql

@@ -0,0 +1,6 @@
+CREATE TABLE IF NOT EXISTS "tenant_update_configs" (
+  "tenant_id" text PRIMARY KEY NOT NULL,
+  "mode" text DEFAULT 'manual' NOT NULL,
+  "preferred_hour_utc" integer DEFAULT 3 NOT NULL,
+  "updated_at" bigint NOT NULL
+);

package/drizzle/migrations/meta/_journal.json

@@ -64,6 +64,13 @@
       "when": 1742313600000,
       "tag": "0008_payment_methods",
       "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "7",
+      "when": 1742400000000,
+      "tag": "0009_tenant_update_configs",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wopr-network/platform-core",
-  "version": "1.26.0",
+  "version": "1.27.1",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/db/schema/index.ts

@@ -64,6 +64,7 @@ export * from "./tenant-capability-settings.js";
 export * from "./tenant-customers.js";
 export * from "./tenant-model-selection.js";
 export * from "./tenant-status.js";
+export * from "./tenant-update-configs.js";
 export * from "./tenants.js";
 export * from "./user-roles.js";
 export * from "./vps-subscriptions.js";

package/src/db/schema/tenant-update-configs.ts

@@ -0,0 +1,16 @@
+import { bigint, integer, pgTable, text } from "drizzle-orm/pg-core";
+
+/**
+ * Per-tenant update configuration — controls whether a tenant's bots
+ * are updated automatically or require manual intervention.
+ */
+export const tenantUpdateConfigs = pgTable("tenant_update_configs", {
+  /** Owning tenant (one config per tenant) */
+  tenantId: text("tenant_id").primaryKey(),
+  /** Update mode: 'auto' for automatic updates, 'manual' for opt-in */
+  mode: text("mode").notNull().default("manual"),
+  /** Preferred hour (0-23 UTC) for automatic updates */
+  preferredHourUtc: integer("preferred_hour_utc").notNull().default(3),
+  /** Epoch ms of last config change */
+  updatedAt: bigint("updated_at", { mode: "number" }).notNull(),
+});

package/src/fleet/__tests__/tenant-update-config-repository.test.ts

@@ -0,0 +1,69 @@
+import type { PGlite } from "@electric-sql/pglite";
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import type { DrizzleDb } from "../../db/index.js";
+import { beginTestTransaction, createTestDb, endTestTransaction, rollbackTestTransaction } from "../../test/db.js";
+import { DrizzleTenantUpdateConfigRepository } from "../drizzle-tenant-update-config-repository.js";
+
+describe("DrizzleTenantUpdateConfigRepository", () => {
+  let db: DrizzleDb;
+  let pool: PGlite;
+  let repo: DrizzleTenantUpdateConfigRepository;
+
+  beforeAll(async () => {
+    ({ db, pool } = await createTestDb());
+    await beginTestTransaction(pool);
+  });
+
+  afterAll(async () => {
+    await endTestTransaction(pool);
+    await pool.close();
+  });
+
+  beforeEach(async () => {
+    await rollbackTestTransaction(pool);
+    repo = new DrizzleTenantUpdateConfigRepository(db);
+  });
+
+  it("get returns null for unknown tenant", async () => {
+    expect(await repo.get("nonexistent")).toBeNull();
+  });
+
+  it("upsert creates a new config", async () => {
+    await repo.upsert("tenant-1", { mode: "auto", preferredHourUtc: 5 });
+    const config = await repo.get("tenant-1");
+    expect(config).not.toBeNull();
+    expect(config?.tenantId).toBe("tenant-1");
+    expect(config?.mode).toBe("auto");
+    expect(config?.preferredHourUtc).toBe(5);
+    expect(config?.updatedAt).toBeGreaterThan(0);
+  });
+
+  it("upsert updates an existing config", async () => {
+    await repo.upsert("tenant-1", { mode: "auto", preferredHourUtc: 5 });
+    const before = await repo.get("tenant-1");
+
+    await repo.upsert("tenant-1", { mode: "manual", preferredHourUtc: 12 });
+    const after = await repo.get("tenant-1");
+
+    expect(after?.mode).toBe("manual");
+    expect(after?.preferredHourUtc).toBe(12);
+    expect(after?.updatedAt).toBeGreaterThanOrEqual(before?.updatedAt ?? 0);
+  });
+
+  it("listAutoEnabled returns only auto-mode tenants", async () => {
+    await repo.upsert("tenant-auto-1", { mode: "auto", preferredHourUtc: 3 });
+    await repo.upsert("tenant-auto-2", { mode: "auto", preferredHourUtc: 8 });
+    await repo.upsert("tenant-manual", { mode: "manual", preferredHourUtc: 0 });
+
+    const autoConfigs = await repo.listAutoEnabled();
+    expect(autoConfigs).toHaveLength(2);
+    expect(autoConfigs.every((c) => c.mode === "auto")).toBe(true);
+    expect(autoConfigs.map((c) => c.tenantId).sort()).toEqual(["tenant-auto-1", "tenant-auto-2"]);
+  });
+
+  it("listAutoEnabled returns empty array when none enabled", async () => {
+    await repo.upsert("tenant-manual", { mode: "manual", preferredHourUtc: 0 });
+    const autoConfigs = await repo.listAutoEnabled();
+    expect(autoConfigs).toEqual([]);
+  });
+});

package/src/fleet/drizzle-tenant-update-config-repository.ts

@@ -0,0 +1,48 @@
+import { eq } from "drizzle-orm";
+import type { DrizzleDb } from "../db/index.js";
+import { tenantUpdateConfigs } from "../db/schema/index.js";
+import type { ITenantUpdateConfigRepository, TenantUpdateConfig } from "./tenant-update-config-repository.js";
+
+/** Drizzle-backed implementation of ITenantUpdateConfigRepository. */
+export class DrizzleTenantUpdateConfigRepository implements ITenantUpdateConfigRepository {
+  constructor(private readonly db: DrizzleDb) {}
+
+  async get(tenantId: string): Promise<TenantUpdateConfig | null> {
+    const rows = await this.db.select().from(tenantUpdateConfigs).where(eq(tenantUpdateConfigs.tenantId, tenantId));
+    return rows[0] ? toConfig(rows[0]) : null;
+  }
+
+  async upsert(tenantId: string, config: Omit<TenantUpdateConfig, "tenantId" | "updatedAt">): Promise<void> {
+    const now = Date.now();
+    await this.db
+      .insert(tenantUpdateConfigs)
+      .values({
+        tenantId,
+        mode: config.mode,
+        preferredHourUtc: config.preferredHourUtc,
+        updatedAt: now,
+      })
+      .onConflictDoUpdate({
+        target: tenantUpdateConfigs.tenantId,
+        set: {
+          mode: config.mode,
+          preferredHourUtc: config.preferredHourUtc,
+          updatedAt: now,
+        },
+      });
+  }
+
+  async listAutoEnabled(): Promise<TenantUpdateConfig[]> {
+    const rows = await this.db.select().from(tenantUpdateConfigs).where(eq(tenantUpdateConfigs.mode, "auto"));
+    return rows.map(toConfig);
+  }
+}
+
+function toConfig(row: typeof tenantUpdateConfigs.$inferSelect): TenantUpdateConfig {
+  return {
+    tenantId: row.tenantId,
+    mode: row.mode as "auto" | "manual",
+    preferredHourUtc: row.preferredHourUtc,
+    updatedAt: row.updatedAt,
+  };
+}

package/src/fleet/fleet-event-emitter.ts

@@ -1,7 +1,14 @@
 import { logger } from "../config/logger.js";
 import type { IFleetEventRepository } from "./fleet-event-repository.js";
 
-export type BotEventType = "bot.started" | "bot.stopped" | "bot.created" | "bot.removed" | "bot.restarted";
+export type BotEventType =
+  | "bot.started"
+  | "bot.stopped"
+  | "bot.created"
+  | "bot.removed"
+  | "bot.restarted"
+  | "bot.updated"
+  | "bot.update_failed";
 
 export type NodeEventType =
   | "node.provisioned"

package/src/fleet/index.ts

@@ -1,7 +1,9 @@
+export * from "./drizzle-tenant-update-config-repository.js";
 export * from "./init-fleet-updater.js";
 export * from "./repository-types.js";
 export * from "./rollout-orchestrator.js";
 export * from "./rollout-strategy.js";
 export * from "./services.js";
+export * from "./tenant-update-config-repository.js";
 export * from "./types.js";
 export * from "./volume-snapshot-manager.js";

package/src/fleet/init-fleet-updater.ts

@@ -14,11 +14,13 @@
 import type Docker from "dockerode";
 import { logger } from "../config/logger.js";
 import type { IBotProfileRepository } from "./bot-profile-repository.js";
+import type { FleetEventEmitter } from "./fleet-event-emitter.js";
 import type { FleetManager } from "./fleet-manager.js";
 import { ImagePoller } from "./image-poller.js";
 import type { IProfileStore } from "./profile-store.js";
 import { RolloutOrchestrator, type RolloutResult } from "./rollout-orchestrator.js";
 import { createRolloutStrategy, type RollingWaveOptions } from "./rollout-strategy.js";
+import type { ITenantUpdateConfigRepository } from "./tenant-update-config-repository.js";
 import { ContainerUpdater } from "./updater.js";
 import { VolumeSnapshotManager } from "./volume-snapshot-manager.js";
 
@@ -33,6 +35,10 @@ export interface FleetUpdaterConfig {
   onBotUpdated?: (result: { botId: string; success: boolean; volumeRestored: boolean }) => void;
   /** Called when a rollout completes */
   onRolloutComplete?: (result: RolloutResult) => void;
+  /** Optional per-tenant update config repository. When provided, tenants with mode=manual are excluded. */
+  configRepo?: ITenantUpdateConfigRepository;
+  /** Optional fleet event emitter. When provided, bot.updated / bot.update_failed events are emitted. */
+  eventEmitter?: FleetEventEmitter;
 }
 
 export interface FleetUpdaterHandle {
@@ -69,6 +75,8 @@ export function initFleetUpdater(
     snapshotDir = "/data/fleet/snapshots",
     onBotUpdated,
     onRolloutComplete,
+    configRepo,
+    eventEmitter,
   } = config;
 
   const poller = new ImagePoller(docker, profileStore);
@@ -82,10 +90,37 @@ export function initFleetUpdater(
     strategy,
     getUpdatableProfiles: async () => {
       const profiles = await profileRepo.list();
-      return profiles.filter((p) => p.updatePolicy !== "manual");
+      const nonManualPolicy = profiles.filter((p) => p.updatePolicy !== "manual");
+
+      if (!configRepo) return nonManualPolicy;
+
+      // Filter out tenants whose per-tenant config is set to manual
+      const results = await Promise.all(
+        nonManualPolicy.map(async (p) => {
+          const tenantCfg = await configRepo.get(p.tenantId);
+          // If tenant has an explicit config with mode=manual, exclude
+          if (tenantCfg && tenantCfg.mode === "manual") return null;
+          return p;
+        }),
+      );
+      return results.filter((p) => p !== null);
+    },
+    onBotUpdated: (result) => {
+      // Emit fleet events if emitter is provided
+      if (eventEmitter) {
+        eventEmitter.emit({
+          type: result.success ? "bot.updated" : "bot.update_failed",
+          botId: result.botId,
+          tenantId: "",
+          timestamp: new Date().toISOString(),
+        });
+      }
+      // Chain user-provided callback
+      onBotUpdated?.(result);
+    },
+    onRolloutComplete: (result) => {
+      onRolloutComplete?.(result);
     },
-    onBotUpdated,
-    onRolloutComplete,
   });
 
   // Wire the detection → orchestration pipeline.

package/src/fleet/services.ts

@@ -50,6 +50,7 @@ import { DrizzleBotProfileRepository } from "./drizzle-bot-profile-repository.js
 import { DrizzleFleetEventRepository } from "./drizzle-fleet-event-repository.js";
 import { DrizzleNodeRepository } from "./drizzle-node-repository.js";
 import { DrizzleRecoveryRepository } from "./drizzle-recovery-repository.js";
+import { DrizzleTenantUpdateConfigRepository } from "./drizzle-tenant-update-config-repository.js";
 import { FleetEventEmitter } from "./fleet-event-emitter.js";
 import type { IFleetEventRepository } from "./fleet-event-repository.js";
 import type { IGpuAllocationRepository } from "./gpu-allocation-repository.js";
@@ -76,6 +77,7 @@ import type { IRecoveryRepository } from "./recovery-repository.js";
 import type { IRegistrationTokenRepository } from "./registration-token-store.js";
 import { DrizzleRegistrationTokenRepository } from "./registration-token-store.js";
 import { DrizzleSpendingCapStore } from "./spending-cap-repository.js";
+import type { ITenantUpdateConfigRepository } from "./tenant-update-config-repository.js";
 import type { IVpsRepository } from "./vps-repository.js";
 import { DrizzleVpsRepository } from "./vps-repository.js";
 
@@ -128,6 +130,9 @@ let _fleetEventEmitter: FleetEventEmitter | null = null;
 // Fleet event repository
 let _fleetEventRepo: IFleetEventRepository | null = null;
 
+// Tenant update config
+let _tenantUpdateConfigRepo: ITenantUpdateConfigRepository | null = null;
+
 // Infrastructure
 let _doClient: DOClient | null = null;
 let _nodeProvider: INodeProvider | null = null;
@@ -403,6 +408,13 @@ export function getFleetEventRepo(): IFleetEventRepository {
   return _fleetEventRepo;
 }
 
+export function getTenantUpdateConfigRepo(): ITenantUpdateConfigRepository {
+  if (!_tenantUpdateConfigRepo) {
+    _tenantUpdateConfigRepo = new DrizzleTenantUpdateConfigRepository(getDb());
+  }
+  return _tenantUpdateConfigRepo;
+}
+
 // ---------------------------------------------------------------------------
 // HeartbeatWatchdog
 // ---------------------------------------------------------------------------
@@ -894,6 +906,7 @@ export function _resetForTest(): void {
   _inferenceWatchdog = null;
   _fleetEventRepo = null;
   _fleetEventEmitter = null;
+  _tenantUpdateConfigRepo = null;
   _doClient = null;
   _nodeProvider = null;
   _nodeProvisioner = null;

package/src/fleet/tenant-update-config-repository.ts

@@ -0,0 +1,12 @@
+export interface TenantUpdateConfig {
+  tenantId: string;
+  mode: "auto" | "manual";
+  preferredHourUtc: number;
+  updatedAt: number;
+}
+
+export interface ITenantUpdateConfigRepository {
+  get(tenantId: string): Promise<TenantUpdateConfig | null>;
+  upsert(tenantId: string, config: Omit<TenantUpdateConfig, "tenantId" | "updatedAt">): Promise<void>;
+  listAutoEnabled(): Promise<TenantUpdateConfig[]>;
+}

package/src/trpc/fleet-update-config-router.ts

@@ -0,0 +1,31 @@
+import { z } from "zod";
+import { logger } from "../config/logger.js";
+import type { ITenantUpdateConfigRepository } from "../fleet/tenant-update-config-repository.js";
+import { protectedProcedure, router } from "./init.js";
+
+export function createFleetUpdateConfigRouter(getConfigRepo: () => ITenantUpdateConfigRepository) {
+  return router({
+    getUpdateConfig: protectedProcedure.input(z.object({ tenantId: z.string().min(1) })).query(async ({ input }) => {
+      return getConfigRepo().get(input.tenantId);
+    }),
+
+    setUpdateConfig: protectedProcedure
+      .input(
+        z.object({
+          tenantId: z.string().min(1),
+          mode: z.enum(["auto", "manual"]),
+          preferredHourUtc: z.number().int().min(0).max(23).optional(),
+        }),
+      )
+      .mutation(async ({ input }) => {
+        await getConfigRepo().upsert(input.tenantId, {
+          mode: input.mode,
+          preferredHourUtc: input.preferredHourUtc ?? 3,
+        });
+        logger.info("Tenant update config changed", {
+          tenantId: input.tenantId,
+          mode: input.mode,
+        });
+      }),
+  });
+}

package/src/trpc/index.ts

@@ -1,3 +1,4 @@
+export { createFleetUpdateConfigRouter } from "./fleet-update-config-router.js";
 export {
   adminProcedure,
   createCallerFactory,