ag-ai 0.1.0

package/dist/internal/node-cache.js

@@ -0,0 +1,104 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TypedNodeCache = void 0;
+const node_cache_1 = __importDefault(require("node-cache"));
+class TypedNodeCache {
+    cache;
+    constructor(options = {}) {
+        this.cache = new node_cache_1.default({
+            stdTTL: 3600, // 1 hour default
+            checkperiod: 120, // Check for expired keys every 2 minutes default
+            ...options,
+        });
+    }
+    /**
+     * Normalizes the key to lowercase for case-insensitive operations
+     */
+    normalizeKey(key) {
+        return key.toLowerCase();
+    }
+    /**
+     * Get a value from the cache
+     */
+    get(key) {
+        return this.cache.get(this.normalizeKey(key));
+    }
+    /**
+     * Set a value in the cache
+     */
+    set(key, value, ttl) {
+        if (ttl !== undefined) {
+            return this.cache.set(this.normalizeKey(key), value, ttl);
+        }
+        return this.cache.set(this.normalizeKey(key), value);
+    }
+    /**
+     * Delete a key from the cache
+     */
+    del(key) {
+        return this.cache.del(this.normalizeKey(key));
+    }
+    /**
+     * Check if a key exists in the cache
+     */
+    has(key) {
+        return this.cache.has(this.normalizeKey(key));
+    }
+    /**
+     * Get multiple values from the cache
+     */
+    mget(keys) {
+        const normalizedKeys = keys.map((key) => this.normalizeKey(key));
+        return this.cache.mget(normalizedKeys);
+    }
+    /**
+     * Set multiple values in the cache
+     */
+    mset(keyValuePairs) {
+        const normalizedPairs = keyValuePairs.map((pair) => ({
+            ...pair,
+            key: this.normalizeKey(pair.key),
+        }));
+        return this.cache.mset(normalizedPairs);
+    }
+    /**
+     * Get all keys in the cache
+     */
+    keys() {
+        return this.cache.keys();
+    }
+    /**
+     * Get cache statistics
+     */
+    getStats() {
+        return this.cache.getStats();
+    }
+    /**
+     * Flush all data from the cache
+     */
+    flushAll() {
+        this.cache.flushAll();
+    }
+    /**
+     * Close the cache and clear all timers
+     */
+    close() {
+        this.cache.close();
+    }
+    /**
+     * Get the TTL for a key
+     */
+    getTtl(key) {
+        return this.cache.getTtl(this.normalizeKey(key));
+    }
+    /**
+     * Set the TTL for a key
+     */
+    ttl(key, ttl) {
+        return this.cache.ttl(this.normalizeKey(key), ttl);
+    }
+}
+exports.TypedNodeCache = TypedNodeCache;

package/dist/internal/retryOnError.d.ts

@@ -0,0 +1,26 @@
+export declare const overloadedMessages: string[];
+export declare const retryableErrorMessages: string[];
+export declare const isOverloadedApiKeyError: (error: unknown) => boolean;
+export declare const isRetryableApiError: (error: unknown) => boolean;
+export type RetryOnErrorOptions = {
+    /** Number of retries after the initial attempt. Defaults to 1. */
+    retries?: number;
+    /** Delay between attempts in ms. Defaults to 2000. */
+    errorDelay?: number;
+    /** Predicate deciding whether a failure is worth retrying. */
+    errorCheck?: (error: unknown) => boolean;
+    /** AbortSignal cancelling the backoff sleep and further attempts. */
+    signal?: AbortSignal;
+    /**
+     * Delay before each attempt after the first, in ms. It composes with
+     * errorDelay: the attempt waits for initialDelayMs plus errorDelay.
+     * Defaults to 0 (no pacing).
+     */
+    initialDelayMs?: number;
+    /** Sleep implementation, overridable in tests. */
+    sleepFn?: (ms: number) => Promise<unknown>;
+};
+export declare function retryOnError<T>(
+/** so we can log retries with useful info */
+debugIdent: string, fn: () => Promise<T>, retriesOrOptions?: number | RetryOnErrorOptions, errorDelay?: number, errorCheck?: (error: unknown) => boolean, signal?: AbortSignal): Promise<T>;
+export declare const sleep: (ms: number) => Promise<unknown>;

package/dist/internal/retryOnError.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sleep = exports.isRetryableApiError = exports.isOverloadedApiKeyError = exports.retryableErrorMessages = exports.overloadedMessages = void 0;
+exports.retryOnError = retryOnError;
+const log_1 = require("./log");
+exports.overloadedMessages = [
+    '429',
+    'current usage',
+    'current quota',
+    'overloaded',
+    'quota exceeded',
+    'quota failure',
+    'rate limited',
+    'too many requests',
+    'generate_content_free_tier_requests',
+    'generaterequestsperday',
+    'high demand',
+    'model pool exhausted',
+    'no available model',
+];
+exports.retryableErrorMessages = [
+    ...exports.overloadedMessages,
+    '500',
+    '503',
+    'safety',
+    'invalid_type',
+    'expected',
+];
+const errorText = (error) => {
+    if (typeof error === 'string') {
+        return error;
+    }
+    if (error instanceof Error) {
+        const nested = error.cause;
+        const nestedText = nested === undefined ? '' : ` ${errorText(nested)}`;
+        return `${error.message}${nestedText}`;
+    }
+    if (typeof error === 'object' && error !== null) {
+        try {
+            return JSON.stringify(error);
+        }
+        catch {
+            return Object.prototype.toString.call(error);
+        }
+    }
+    return String(error);
+};
+const errorContainsAnyMessage = (error, messages) => {
+    const message = errorText(error).toLowerCase();
+    return messages.some((m) => message.includes(m.toLowerCase()));
+};
+const isOverloadedApiKeyError = (error) => errorContainsAnyMessage(error, exports.overloadedMessages);
+exports.isOverloadedApiKeyError = isOverloadedApiKeyError;
+const isRetryableApiError = (error) => errorContainsAnyMessage(error, exports.retryableErrorMessages);
+exports.isRetryableApiError = isRetryableApiError;
+const createAbortError = () => {
+    const error = new Error('Operation aborted');
+    error.name = 'AbortError';
+    return error;
+};
+const awaitWithSignal = async (promise, signal) => {
+    if (signal === undefined)
+        return promise;
+    if (signal.aborted)
+        throw createAbortError();
+    const abort = new Promise((_, reject) => {
+        const onAbort = () => reject(createAbortError());
+        signal.addEventListener('abort', onAbort, { once: true });
+        void promise.then(() => signal.removeEventListener('abort', onAbort), () => signal.removeEventListener('abort', onAbort));
+    });
+    return Promise.race([promise, abort]);
+};
+const normalizeRetryOnErrorOptions = (retriesOrOptions, errorDelay, errorCheck, signal) => ({
+    retries: typeof retriesOrOptions === 'number' ? retriesOrOptions : (retriesOrOptions?.retries ?? 1),
+    errorDelay: typeof retriesOrOptions === 'number'
+        ? (errorDelay ?? 2000)
+        : (retriesOrOptions?.errorDelay ?? 2000),
+    errorCheck: typeof retriesOrOptions === 'number'
+        ? (errorCheck ?? exports.isRetryableApiError)
+        : (retriesOrOptions?.errorCheck ?? exports.isRetryableApiError),
+    signal: typeof retriesOrOptions === 'number' ? signal : (retriesOrOptions?.signal ?? signal),
+    initialDelayMs: typeof retriesOrOptions === 'number' ? 0 : Math.max(0, retriesOrOptions?.initialDelayMs ?? 0),
+    sleepFn: typeof retriesOrOptions === 'number' ? undefined : retriesOrOptions?.sleepFn,
+});
+async function retryOnError(
+/** so we can log retries with useful info */
+debugIdent, fn, retriesOrOptions, errorDelay, errorCheck = exports.isRetryableApiError, signal) {
+    const options = normalizeRetryOnErrorOptions(retriesOrOptions, errorDelay, errorCheck, signal);
+    const sleepWithSignal = async (ms) => {
+        if (ms <= 0)
+            return;
+        if (options.sleepFn !== undefined) {
+            await options.sleepFn(ms);
+            return;
+        }
+        await awaitWithSignal((0, exports.sleep)(ms), options.signal);
+    };
+    // Pacing delay before attempts after the first: it spreads bursty fan-out
+    // (e.g. nightly jobs hitting a low free-tier quota) without changing the
+    // retry semantics for direct callers.
+    await sleepWithSignal(options.initialDelayMs);
+    try {
+        const result = await fn();
+        return result;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (options.retries > 0 && options.errorCheck(error)) {
+            (0, log_1.info)(`Operation ${debugIdent} failed. Retrying after ${options.errorDelay}ms...`, message);
+            await sleepWithSignal(options.errorDelay);
+            return retryOnError(debugIdent, fn, {
+                retries: options.retries - 1,
+                errorDelay: options.errorDelay,
+                errorCheck: options.errorCheck,
+                signal: options.signal,
+                sleepFn: options.sleepFn,
+            });
+        }
+        throw error;
+    }
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+exports.sleep = sleep;

package/dist/internal/string/redact.d.ts

@@ -0,0 +1,2 @@
+export declare function redactString(str: string): string;
+export declare function redactObject<T>(ob: T): T;

package/dist/internal/string/redact.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactString = redactString;
+exports.redactObject = redactObject;
+function redactString(str) {
+    let ret = str;
+    ret = ret || '';
+    const repl = '$1<redacted>$2';
+    // OAuth and authentication tokens
+    ret = ret.replace(/(\b)grant_type.+?(\b)/gm, repl);
+    ret = ret.replace(/(\b)Bearer .+?(\b)/gm, repl);
+    // JWT tokens (base64 with dots)
+    ret = ret.replace(/(eyJ[\w-_.]*\.[\w-_.]*\.[\w-_.]*)/gim, '<redacted>');
+    // API Keys (various formats)
+    ret = ret.replace(/(\b)(sk_live_|sk_test_|pk_live_|pk_test_)[\w-]+/gi, '$1<redacted>'); // Stripe
+    ret = ret.replace(/(\b)(AKIA[0-9A-Z]{16})/gi, '$1<redacted>'); // AWS Access Key ID
+    ret = ret.replace(/(aws_secret_access_key["\s]*[:=]["\s]*)([0-9a-zA-Z/+]{40})/gi, '$1<redacted>'); // AWS Secret Access Key pattern
+    ret = ret.replace(/(\b)(AIza[0-9A-Za-z\\-_]{35})/gi, '$1<redacted>'); // Google API Key
+    ret = ret.replace(/(\b)(ya29\.[0-9A-Za-z\\-_]+)/gi, '$1<redacted>'); // Google OAuth Access Token
+    ret = ret.replace(/(\b)(glpat-[a-zA-Z0-9\\-_]{20})/gi, '$1<redacted>'); // GitLab Personal Access Token
+    ret = ret.replace(/(\b)(ghp_[a-zA-Z0-9]{36})/gi, '$1<redacted>'); // GitHub Personal Access Token
+    ret = ret.replace(/(\b)(github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59})/gi, '$1<redacted>'); // GitHub Fine-grained PAT
+    // Password patterns in key-value pairs
+    ret = ret.replace(/(password["\s]*[:=]["\s]*)([^",\s}]+)/gi, '$1<redacted>');
+    ret = ret.replace(/(passwd["\s]*[:=]["\s]*)([^",\s}]+)/gi, '$1<redacted>');
+    ret = ret.replace(/(pwd["\s]*[:=]["\s]*)([^",\s}]+)/gi, '$1<redacted>');
+    ret = ret.replace(/(secret["\s]*[:=]["\s]*)([^",\s}]+)/gi, '$1<redacted>');
+    ret = ret.replace(/(token["\s]*[:=]["\s]*)([^",\s}]+)/gi, '$1<redacted>');
+    ret = ret.replace(/(^|[^a-zA-Z])(api_?key|private_?key|secret_?key)["\s]*[:=]["\s]*([^",\s}]+)/gi, '$1$2<redacted>');
+    ret = ret.replace(/(auth["\s]*[:=]["\s]*)([^",\s}]+)/gi, '$1<redacted>');
+    // Database connection strings
+    ret = ret.replace(/(mongodb:\/\/[^:]+:)([^@]+)(@)/gi, '$1<redacted>$3');
+    ret = ret.replace(/(mysql:\/\/[^:]+:)([^@]+)(@)/gi, '$1<redacted>$3');
+    ret = ret.replace(/(postgresql:\/\/[^:]+:)([^@]+)(@)/gi, '$1<redacted>$3');
+    ret = ret.replace(/(redis:\/\/[^:]+:)([^@]+)(@)/gi, '$1<redacted>$3');
+    // Credit card numbers (basic pattern)
+    ret = ret.replace(/(\b)([3-6]\d{3}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{3,4})(\b)/g, '$1<redacted>$3');
+    // Social Security Numbers (US format)
+    ret = ret.replace(/(\b)(\d{3}[-\s]?\d{2}[-\s]?\d{4})(\b)/g, '$1<redacted>$3');
+    // Private keys
+    ret = ret.replace(/(-----BEGIN [A-Z\s]+PRIVATE KEY-----)([\s\S]*?)(-----END [A-Z\s]+PRIVATE KEY-----)/gi, '$1\n<redacted>\n$3');
+    // Session IDs and UUIDs in headers/cookies
+    ret = ret.replace(/(sessionid["\s]*[:=]["\s]*)([a-zA-Z0-9]{32,})/gi, '$1<redacted>');
+    ret = ret.replace(/(session["\s]*[:=]["\s]*)([a-zA-Z0-9]{32,})/gi, '$1<redacted>');
+    ret = ret.replace(/(csrftoken["\s]*[:=]["\s]*)([a-zA-Z0-9]{32,})/gi, '$1<redacted>');
+    // Common environment variable patterns
+    ret = ret.replace(/(DATABASE_URL["\s]*[:=]["\s]*)([^",\s}]+)/gi, '$1<redacted>');
+    ret = ret.replace(/(REDIS_URL["\s]*[:=]["\s]*)([^",\s}]+)/gi, '$1<redacted>');
+    ret = ret.replace(/(SMTP_PASSWORD["\s]*[:=]["\s]*)([^",\s}]+)/gi, '$1<redacted>');
+    ret = ret.replace(/(ENCRYPTION_KEY["\s]*[:=]["\s]*)([^",\s}]+)/gi, '$1<redacted>');
+    // High entropy strings and long base64-like strings
+    ret = ret.replace(/\b([a-zA-Z0-9+/=_-]{20,})\b/g, (match) => {
+        // If it ends with ==, it's almost certainly a base64 string provided it is long enough
+        // We use a slightly higher length threshold for this specific check to be safe
+        if (match.endsWith('==') && match.length > 30) {
+            return '<redacted>';
+        }
+        // Check entropy for other long strings
+        if (getShannonEntropy(match) > 4.5) {
+            return '<redacted>';
+        }
+        return match;
+    });
+    return ret;
+}
+function getShannonEntropy(str) {
+    const len = str.length;
+    if (len === 0)
+        return 0;
+    const frequencies = new Map();
+    for (const char of str) {
+        frequencies.set(char, (frequencies.get(char) ?? 0) + 1);
+    }
+    let entropy = 0;
+    for (const count of frequencies.values()) {
+        const p = count / len;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+function redactObject(ob) {
+    if (typeof ob === 'string') {
+        return redactString(ob);
+    }
+    else if (typeof ob === 'object') {
+        try {
+            return JSON.parse(redactString(JSON.stringify(ob)));
+        }
+        catch {
+            return ob;
+        }
+    }
+    return ob;
+}

package/dist/internal/string/truncate.d.ts

@@ -0,0 +1,8 @@
+/** truncate text */
+export declare function truncate(
+/** string to truncate */
+str: string, 
+/** max length */
+n: number, 
+/** default '...' */
+ellip?: string): string;

package/dist/internal/string/truncate.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.truncate = truncate;
+/** truncate text */
+function truncate(
+/** string to truncate */
+str, 
+/** max length */
+n, 
+/** default '...' */
+ellip = '...') {
+    if (!str) {
+        return str;
+    }
+    return str.length > n ? str.slice(0, n - 1) + ellip : str;
+}

package/dist/k8s/assets/network-init.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+set -eu
+
+# Runs only in this pod's network namespace, before the runtime container.
+# No host networking, host mounts, credentials, or privileged container required.
+# Fail startup if either address family's rules cannot be installed.
+apk add --no-cache --no-scripts iptables
+
+iptables-restore <<'RULES'
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT DROP [0:0]
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -s __GENERATION_CIDR__ -p tcp --dport __GENERATION_PORT__ -j ACCEPT
+-A OUTPUT -o lo -j ACCEPT
+-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+__DNS_RULES__
+-A OUTPUT -p tcp --dport __OPENCODE_PORT__ -j ACCEPT
+-A OUTPUT -d 0.0.0.0/8 -j REJECT
+-A OUTPUT -d 10.0.0.0/8 -j REJECT
+-A OUTPUT -d 100.64.0.0/10 -j REJECT
+-A OUTPUT -d 127.0.0.0/8 -j REJECT
+-A OUTPUT -d 169.254.0.0/16 -j REJECT
+-A OUTPUT -d 172.16.0.0/12 -j REJECT
+-A OUTPUT -d 192.0.0.0/24 -j REJECT
+-A OUTPUT -d 192.0.2.0/24 -j REJECT
+__GENERATION_REJECT__
+-A OUTPUT -d 198.18.0.0/15 -j REJECT
+-A OUTPUT -d 198.51.100.0/24 -j REJECT
+-A OUTPUT -d 203.0.113.0/24 -j REJECT
+-A OUTPUT -d 224.0.0.0/4 -j REJECT
+-A OUTPUT -d 240.0.0.0/4 -j REJECT
+-A OUTPUT -p tcp --dport 443 -j ACCEPT
+COMMIT
+RULES
+
+# There is no IPv6 dependency; deny it entirely except pod loopback. This also
+# closes IPv4-mapped, NAT64, link-local, and private IPv6 bypasses.
+ip6tables-restore <<'RULES'
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT DROP [0:0]
+-A INPUT -i lo -j ACCEPT
+-A OUTPUT -o lo -j ACCEPT
+-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+COMMIT
+RULES
+
+echo 'ag-ai pod firewall installed: authenticated LAN generation ingress; cluster DNS, OpenCode, and public IPv4 HTTPS egress'

package/dist/k8s/common.d.ts

@@ -0,0 +1,35 @@
+import type { V1EnvVar, V1Volume, V1VolumeMount } from '@kubernetes/client-node';
+import type { ClusterFacilities, IStack, SecretReference } from 'ag-rpi-mega';
+/** The plugin owns its identity; addresses, hosts, and secrets come from the host. */
+export declare const NAMESPACE = "ag-ai";
+export declare const OPENCODE_APP = "ag-ai-opencode";
+export declare const RUNNER_APP = "ag-ai-runner";
+export declare const T3CODE_APP = "ag-ai-t3code";
+export declare const OPENCODE_PORT = 4096;
+export declare const GENERATION_PORT = 4501;
+export declare const T3_PORT = 4001;
+export declare const OPENCODE_SERVICE = "server";
+export declare const RUNNER_SERVICE = "generation";
+export declare const T3_SERVICE = "server";
+export declare const METAL_LB_KEY = "ag-ai";
+/** Mirrors the SDK's resource naming so service DNS is deterministic. */
+export declare const resourceName: (appName: string, name: string) => string;
+export declare const serviceUrl: (facilities: ClusterFacilities, appName: string, name: string, port: number) => string;
+/** StorageClass and PersistentVolume are cluster-scoped; the SDK adds a namespace. */
+export declare const stripClusterScopedNamespaces: (stack: IStack) => void;
+export interface SecretMount {
+    volume: V1Volume;
+    mount: V1VolumeMount;
+    /** Absolute file path the mounted key resolves to inside the container. */
+    file: string;
+}
+export declare const secretMount: (name: string, reference: SecretReference) => SecretMount;
+export declare const env: (name: string, value: string) => V1EnvVar;
+/** OpenCode health probe with basic auth, evaluated inside the container. */
+export declare const openCodeHealthProbe: (port: number) => {
+    exec: {
+        command: string[];
+    };
+    timeoutSeconds: number;
+    periodSeconds: number;
+};

package/dist/k8s/common.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openCodeHealthProbe = exports.env = exports.secretMount = exports.stripClusterScopedNamespaces = exports.serviceUrl = exports.resourceName = exports.METAL_LB_KEY = exports.T3_SERVICE = exports.RUNNER_SERVICE = exports.OPENCODE_SERVICE = exports.T3_PORT = exports.GENERATION_PORT = exports.OPENCODE_PORT = exports.T3CODE_APP = exports.RUNNER_APP = exports.OPENCODE_APP = exports.NAMESPACE = void 0;
+const ag_rpi_mega_1 = require("ag-rpi-mega");
+/** The plugin owns its identity; addresses, hosts, and secrets come from the host. */
+exports.NAMESPACE = 'ag-ai';
+exports.OPENCODE_APP = 'ag-ai-opencode';
+exports.RUNNER_APP = 'ag-ai-runner';
+exports.T3CODE_APP = 'ag-ai-t3code';
+exports.OPENCODE_PORT = 4096;
+exports.GENERATION_PORT = 4501;
+exports.T3_PORT = 4001;
+exports.OPENCODE_SERVICE = 'server';
+exports.RUNNER_SERVICE = 'generation';
+exports.T3_SERVICE = 'server';
+exports.METAL_LB_KEY = 'ag-ai';
+/** Mirrors the SDK's resource naming so service DNS is deterministic. */
+const resourceName = (appName, name) => [appName, name].filter(Boolean).join('-');
+exports.resourceName = resourceName;
+const serviceUrl = (facilities, appName, name, port) => `http://${(0, exports.resourceName)(appName, name)}.${exports.NAMESPACE}.svc.${facilities.kubeDomain}:${port}`;
+exports.serviceUrl = serviceUrl;
+/** StorageClass and PersistentVolume are cluster-scoped; the SDK adds a namespace. */
+const stripClusterScopedNamespaces = (stack) => {
+    for (const resource of stack.resources) {
+        if ((resource.kind === 'StorageClass' || resource.kind === 'PersistentVolume') &&
+            resource.metadata) {
+            delete resource.metadata.namespace;
+        }
+    }
+};
+exports.stripClusterScopedNamespaces = stripClusterScopedNamespaces;
+const secretMount = (name, reference) => {
+    const mountPath = `/var/run/secrets/ag-ai/${name}`;
+    const [volume, mount] = (0, ag_rpi_mega_1.credentialVolume)({
+        name: `${name}-credentials`,
+        mountPath,
+        secrets: [reference],
+    });
+    return { volume, mount, file: `${mountPath}/${reference.key}` };
+};
+exports.secretMount = secretMount;
+const env = (name, value) => ({ name, value });
+exports.env = env;
+/** OpenCode health probe with basic auth, evaluated inside the container. */
+const openCodeHealthProbe = (port) => ({
+    exec: {
+        command: [
+            'node',
+            '-e',
+            `fetch('http://127.0.0.1:${port}/global/health',{headers:{authorization:'Basic '+Buffer.from('opencode:'+(process.env.OPENCODE_SERVER_PASSWORD??'')).toString('base64')}}).then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))`,
+        ],
+    },
+    timeoutSeconds: 5,
+    periodSeconds: 10,
+});
+exports.openCodeHealthProbe = openCodeHealthProbe;

package/dist/k8s/index.d.ts

@@ -0,0 +1,9 @@
+import type { ClusterPlugin } from 'ag-rpi-mega';
+/**
+ * ag-ai cluster plugin. All cluster-owned values (images, MetalLB addresses, the
+ * NAS host, architecture, domain, secrets, and the LAN CIDR/queue URL) are
+ * resolved from the host through `ClusterPluginContext`; this package contains
+ * only logical names and generic container paths/ports.
+ */
+export declare const plugin: ClusterPlugin;
+export { NAMESPACE } from './common';

package/dist/k8s/index.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NAMESPACE = exports.plugin = void 0;
+const common_1 = require("./common");
+const opencode_1 = require("./opencode");
+const runner_1 = require("./runner");
+const t3code_1 = require("./t3code");
+/**
+ * ag-ai cluster plugin. All cluster-owned values (images, MetalLB addresses, the
+ * NAS host, architecture, domain, secrets, and the LAN CIDR/queue URL) are
+ * resolved from the host through `ClusterPluginContext`; this package contains
+ * only logical names and generic container paths/ports.
+ */
+exports.plugin = {
+    name: 'ag-ai',
+    namespace: common_1.NAMESPACE,
+    requiredEnv: ['AG_AI_QUEUE_URL', 'AG_AI_GENERATION_CIDR'],
+    requiredSecrets: [
+        'runner-token',
+        'generation-token',
+        'analytica-token',
+        'opencode-password',
+        'image-api-key',
+    ],
+    requiredImages: ['ag-ai-runner', 'ag-ai-opencode', 'ag-ai-t3code'],
+    stacks: (context) => [
+        (0, opencode_1.opencodeStack)(context),
+        (0, runner_1.runnerStack)(context),
+        (0, t3code_1.t3codeStack)(context),
+    ],
+};
+var common_2 = require("./common");
+Object.defineProperty(exports, "NAMESPACE", { enumerable: true, get: function () { return common_2.NAMESPACE; } });

package/dist/k8s/opencode.d.ts

@@ -0,0 +1,4 @@
+import { Stack } from 'ag-rpi-mega';
+import type { ClusterPluginContext } from 'ag-rpi-mega';
+/** OpenCode server: durable state, basic auth from a mounted Secret, ClusterIP only. */
+export declare const opencodeStack: (context: ClusterPluginContext) => Stack;

package/dist/k8s/opencode.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.opencodeStack = void 0;
+const ag_rpi_mega_1 = require("ag-rpi-mega");
+const common_1 = require("./common");
+/** OpenCode server: durable state, basic auth from a mounted Secret, ClusterIP only. */
+const opencodeStack = (context) => {
+    const { facilities } = context;
+    const stack = new ag_rpi_mega_1.Stack({ namespace: common_1.NAMESPACE, appName: common_1.OPENCODE_APP, facilities });
+    const [dataVolume, dataMounts] = stack.addNFSVolume({
+        namePrefix: 'state',
+        mountPath: '/data',
+        path: facilities.nfs.exportPath,
+        server: facilities.nfs.hostname,
+        accessMode: 'ReadWriteMany',
+    });
+    (0, common_1.stripClusterScopedNamespaces)(stack);
+    const password = context.secret('opencode-password');
+    const credentials = (0, common_1.secretMount)('opencode-password', password);
+    const probe = (0, common_1.openCodeHealthProbe)(common_1.OPENCODE_PORT);
+    const container = {
+        name: 'opencode',
+        image: facilities.image('ag-ai-opencode'),
+        imagePullPolicy: 'IfNotPresent',
+        command: ['opencode', 'serve', '--hostname', '0.0.0.0', '--port', String(common_1.OPENCODE_PORT)],
+        ports: [{ name: 'opencode', containerPort: common_1.OPENCODE_PORT, protocol: 'TCP' }],
+        env: [
+            (0, ag_rpi_mega_1.secretEnv)('OPENCODE_SERVER_PASSWORD', password),
+            (0, common_1.env)('HOME', '/data/opencode/home'),
+            (0, common_1.env)('XDG_DATA_HOME', '/data/opencode/data'),
+            (0, common_1.env)('XDG_CONFIG_HOME', '/data/opencode/config'),
+            (0, common_1.env)('XDG_CACHE_HOME', '/data/opencode/cache'),
+        ],
+        startupProbe: { ...probe, failureThreshold: 30 },
+        readinessProbe: { ...probe, initialDelaySeconds: 5 },
+        livenessProbe: { ...probe, initialDelaySeconds: 15, periodSeconds: 30 },
+        resources: {
+            requests: { cpu: '50m', memory: '256Mi' },
+            limits: { cpu: '1000m', memory: '1Gi' },
+        },
+        volumeMounts: [...dataMounts, credentials.mount, { name: 'tmp', mountPath: '/tmp' }],
+    };
+    stack.addDeployment({
+        name: 'server',
+        containers: [container],
+        volumes: [dataVolume, credentials.volume, { name: 'tmp', emptyDir: { sizeLimit: '256Mi' } }],
+        replicas: 1,
+        architecture: facilities.arch,
+        securityMode: 'None',
+        changeNFSFilePerms: true,
+    });
+    stack.addService({ name: common_1.OPENCODE_SERVICE, tcp: [common_1.OPENCODE_PORT], type: 'ClusterIP' });
+    return stack;
+};
+exports.opencodeStack = opencodeStack;

package/dist/k8s/runner.d.ts

@@ -0,0 +1,4 @@
+import { Stack } from 'ag-rpi-mega';
+import type { ClusterPluginContext } from 'ag-rpi-mega';
+/** Queue worker: OpenCode executor, NFS generation store, LAN-only generation listener. */
+export declare const runnerStack: (context: ClusterPluginContext) => Stack;