Initial commit — SvelteKit fleet manager for T5 Plutonium servers

Ports push_scripts.sh (1497 lines of bash) to a SvelteKit + SQLite web app
that manages a fleet of T5 Plutonium servers running on Komodo. Same push
and beta workflow as the shell script, with a live SSE pipeline view, a
!rt-token-gated auth modal that hard-pauses deployments on stale tokens,
per-file audit diffs, and a Komodo-container deployment target.

- Push/beta engines port the exact filter, held-by-beta, conflict, and
  stale-backup rules from the shell script
- SQLite (better-sqlite3) replaces script_metadata.json; a one-shot
  importer moves legacy state over on first boot
- 16 vitest tests cover push add/update/skip, beta open→rollback,
  open→promote, conflict guards, sweep frozen/manual branches, and IW4M
  login/status parsing
- docker/ + komodo/stack.toml deploy as a managed container on the same
  host as the game servers, /root/zombies bind-mounted at the same path
  the shell script used

src/routes/api/auth/token/+server.ts

@@ -0,0 +1,30 @@
+import { json } from '@sveltejs/kit';
+import { loginWithToken } from '$lib/server/integrations/iw4m.js';
+import { getAuthState, setAuthState } from '$lib/server/integrations/auth-state.js';
+import { kick } from '$lib/server/pipeline/worker.js';
+
+export async function GET() {
+    return json(getAuthState());
+}
+
+export async function POST({ request }: { request: Request }) {
+    const body = (await request.json().catch(() => ({}))) as { token?: string };
+    const token = (body.token ?? '').trim();
+    if (!/^[a-zA-Z0-9]{4}$/.test(token)) {
+        return json({ ok: false, error: 'token must be exactly 4 alphanumeric characters' }, { status: 400 });
+    }
+    const res = await loginWithToken(token);
+    if (!res.ok) {
+        setAuthState({ kind: 'stale', reason: res.reason === 'rejected' ? 'rejected' : 'unreachable' });
+        return json({ ok: false, error: res.message }, { status: res.reason === 'rejected' ? 401 : 502 });
+    }
+    setAuthState({ kind: 'ready', token, cookie: res.cookie, expiresAt: res.expiresAt });
+    // Fresh cookie → immediately drain any queued restarts.
+    void kick();
+    return json({ ok: true, expiresAt: res.expiresAt });
+}
+
+export async function DELETE() {
+    setAuthState({ kind: 'missing' });
+    return json({ ok: true });
+}

src/routes/api/betas/+server.ts

@@ -0,0 +1,59 @@
+import { json } from '@sveltejs/kit';
+import { openBeta, updateBeta, listBetas, listBetaScripts, listBetaServers, BetaError } from '$lib/server/fleet/beta.js';
+import { stagedFiles, findTargets } from '$lib/server/fleet/files.js';
+import { kick } from '$lib/server/pipeline/worker.js';
+
+export async function GET() {
+    const staged = await stagedFiles();
+    const withHints = await Promise.all(
+        staged.map(async (base) => ({
+            base,
+            hits: await findTargets(base)
+        }))
+    );
+    const betas = listBetas().map((b) => ({
+        ...b,
+        servers: listBetaServers(b.slug),
+        scripts: listBetaScripts(b.slug)
+    }));
+    return json({ staged: withHints, betas });
+}
+
+export async function POST({ request }: { request: Request }) {
+    const body = (await request.json().catch(() => ({}))) as {
+        name?: string;
+        patterns?: string[];
+        dryRun?: boolean;
+        create?: boolean;
+    };
+    if (!body.name) return json({ ok: false, error: 'name is required' }, { status: 400 });
+    try {
+        const res = await openBeta({
+            name: body.name,
+            patterns: body.patterns ?? ['*'],
+            dryRun: body.dryRun ?? false,
+            create: body.create ?? false
+        });
+        if (!res.dryRun) void kick();
+        return json({ ok: true, result: res });
+    } catch (err) {
+        if (err instanceof BetaError) {
+            return json({ ok: false, error: err.message, kind: err.kind, details: err.details }, { status: 409 });
+        }
+        throw err;
+    }
+}
+
+export async function PATCH({ request }: { request: Request }) {
+    const body = (await request.json().catch(() => ({}))) as { name?: string; dryRun?: boolean };
+    if (!body.name) return json({ ok: false, error: 'name is required' }, { status: 400 });
+    try {
+        const res = await updateBeta(body.name, body.dryRun ?? false);
+        return json({ ok: true, result: res });
+    } catch (err) {
+        if (err instanceof BetaError) {
+            return json({ ok: false, error: err.message, kind: err.kind, details: err.details }, { status: 409 });
+        }
+        throw err;
+    }
+}

src/routes/api/betas/[slug]/promote/+server.ts

@@ -0,0 +1,17 @@
+import { json } from '@sveltejs/kit';
+import { promoteBeta, BetaError } from '$lib/server/fleet/beta.js';
+import { kick } from '$lib/server/pipeline/worker.js';
+
+export async function POST({ params, request }: { params: { slug: string }; request: Request }) {
+    const body = (await request.json().catch(() => ({}))) as { dryRun?: boolean };
+    try {
+        const res = await promoteBeta(params.slug, body.dryRun ?? false);
+        if (!res.dryRun) void kick();
+        return json({ ok: true, result: res });
+    } catch (err) {
+        if (err instanceof BetaError) {
+            return json({ ok: false, error: err.message, kind: err.kind, details: err.details }, { status: 409 });
+        }
+        throw err;
+    }
+}

src/routes/api/betas/[slug]/rollback/+server.ts

@@ -0,0 +1,18 @@
+import { json } from '@sveltejs/kit';
+import { rollbackBeta, BetaError } from '$lib/server/fleet/beta.js';
+import { kick } from '$lib/server/pipeline/worker.js';
+
+export async function POST({ params, request }: { params: { slug: string }; request: Request }) {
+    const body = (await request.json().catch(() => ({}))) as { dryRun?: boolean };
+    try {
+        // callers pass name; slug in URL is the slugified name — either works
+        const res = await rollbackBeta(params.slug, body.dryRun ?? false);
+        if (!res.dryRun) void kick();
+        return json({ ok: true, result: res });
+    } catch (err) {
+        if (err instanceof BetaError) {
+            return json({ ok: false, error: err.message, kind: err.kind, details: err.details }, { status: 409 });
+        }
+        throw err;
+    }
+}

src/routes/api/deployments/+server.ts

@@ -0,0 +1,51 @@
+import { json } from '@sveltejs/kit';
+import { db } from '$lib/server/db/index.js';
+
+export async function GET({ url }: { url: URL }) {
+    const activeOnly = url.searchParams.get('active') === 'true';
+
+    const deployments = db()
+        .prepare(
+            `SELECT id, action, started_at, finished_at, triggered_by
+             FROM deployments
+             ORDER BY started_at DESC
+             LIMIT 500`
+        )
+        .all() as Array<{
+        id: string;
+        action: string;
+        started_at: string;
+        finished_at: string | null;
+        triggered_by: string | null;
+    }>;
+
+    const serversByDep = db()
+        .prepare(
+            `SELECT deployment_id, server, files_changed, restart_state, players, checked_at, restarted_at, attempts, error
+             FROM deployment_servers`
+        )
+        .all() as Array<{
+        deployment_id: string;
+        server: string;
+        files_changed: number;
+        restart_state: string;
+        players: number | null;
+        checked_at: string | null;
+        restarted_at: string | null;
+        attempts: number;
+        error: string | null;
+    }>;
+
+    const grouped = new Map<string, typeof serversByDep>();
+    for (const s of serversByDep) {
+        const arr = grouped.get(s.deployment_id) ?? [];
+        arr.push(s);
+        grouped.set(s.deployment_id, arr);
+    }
+
+    const rows = deployments
+        .map((d) => ({ ...d, servers: grouped.get(d.id) ?? [] }))
+        .filter((d) => (activeOnly ? d.servers.some((s) => s.restart_state === 'pending' || s.restart_state === 'failed') : true));
+
+    return json({ deployments: rows });
+}

src/routes/api/deployments/[id]/+server.ts

@@ -0,0 +1,28 @@
+import { json, error } from '@sveltejs/kit';
+import { db } from '$lib/server/db/index.js';
+
+export async function GET({ params }: { params: { id: string } }) {
+    const dep = db()
+        .prepare('SELECT * FROM deployments WHERE id = ?')
+        .get(params.id) as Record<string, unknown> | undefined;
+    if (!dep) throw error(404, 'deployment not found');
+
+    const servers = db()
+        .prepare('SELECT * FROM deployment_servers WHERE deployment_id = ? ORDER BY server')
+        .all(params.id);
+
+    // Don't ship blobs in the summary — the client asks for a single file when
+    // it opens the diff viewer.
+    const files = db()
+        .prepare(
+            `SELECT id, server, verb, rel_path, sha256_before, sha256_after,
+                    LENGTH(content_before) AS size_before,
+                    LENGTH(content_after)  AS size_after
+             FROM deployment_files
+             WHERE deployment_id = ?
+             ORDER BY server, rel_path`
+        )
+        .all(params.id);
+
+    return json({ deployment: dep, servers, files });
+}

src/routes/api/deployments/[id]/file/[fileId]/+server.ts

@@ -0,0 +1,34 @@
+import { json, error } from '@sveltejs/kit';
+import { db } from '$lib/server/db/index.js';
+
+// Streams a single deployment_files row's before/after blobs as UTF-8 text
+// so the DiffViewer can render a unified diff without a second query.
+
+export async function GET({ params }: { params: { id: string; fileId: string } }) {
+    const row = db()
+        .prepare(
+            `SELECT verb, rel_path, sha256_before, sha256_after, content_before, content_after
+             FROM deployment_files
+             WHERE deployment_id = ? AND id = ?`
+        )
+        .get(params.id, Number(params.fileId)) as
+        | {
+              verb: string;
+              rel_path: string;
+              sha256_before: string | null;
+              sha256_after: string | null;
+              content_before: Buffer | null;
+              content_after: Buffer | null;
+          }
+        | undefined;
+    if (!row) throw error(404, 'file not found');
+
+    return json({
+        verb: row.verb,
+        relPath: row.rel_path,
+        sha256Before: row.sha256_before,
+        sha256After: row.sha256_after,
+        before: row.content_before ? row.content_before.toString('utf8') : null,
+        after: row.content_after ? row.content_after.toString('utf8') : null
+    });
+}

src/routes/api/events/auth/+server.ts

@@ -0,0 +1,47 @@
+import { subscribe } from '$lib/server/pipeline/bus.js';
+import { getAuthState } from '$lib/server/integrations/auth-state.js';
+
+const encoder = new TextEncoder();
+const HEARTBEAT_MS = 5_000;
+
+export async function GET() {
+    let heartbeat: NodeJS.Timeout | null = null;
+    let unsubscribe: (() => void) | null = null;
+
+    const stream = new ReadableStream<Uint8Array>({
+        start(controller) {
+            const push = () => {
+                const s = getAuthState();
+                const payload = {
+                    type: 'auth-state',
+                    state: s,
+                    msRemaining: s.kind === 'ready' ? Math.max(0, s.expiresAt - Date.now()) : undefined
+                };
+                controller.enqueue(encoder.encode(`event: auth-state\ndata: ${JSON.stringify(payload)}\n\n`));
+            };
+
+            unsubscribe = subscribe((event) => {
+                if (event.type === 'auth-state') {
+                    controller.enqueue(encoder.encode(`event: auth-state\ndata: ${JSON.stringify(event)}\n\n`));
+                }
+            });
+            push();
+            // The auth stream double-serves as the token-countdown feed; the
+            // frontend uses the msRemaining to render a per-second ticker,
+            // so we push every 5s even without a state change.
+            heartbeat = setInterval(push, HEARTBEAT_MS);
+        },
+        cancel() {
+            if (heartbeat) clearInterval(heartbeat);
+            if (unsubscribe) unsubscribe();
+        }
+    });
+
+    return new Response(stream, {
+        headers: {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache, no-transform',
+            Connection: 'keep-alive'
+        }
+    });
+}

src/routes/api/events/pipeline/+server.ts

@@ -0,0 +1,45 @@
+import { subscribe, type PipelineEvent } from '$lib/server/pipeline/bus.js';
+
+// Multiplexed SSE. Every event with a type field goes out. The client filters
+// by type (server-state | deployment-opened | sweep-tick | server-changed).
+
+const encoder = new TextEncoder();
+const HEARTBEAT_MS = 20_000;
+
+function send(controller: ReadableStreamDefaultController<Uint8Array>, event: PipelineEvent): void {
+    controller.enqueue(encoder.encode(`event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`));
+}
+
+export async function GET() {
+    let heartbeat: NodeJS.Timeout | null = null;
+    let unsubscribe: (() => void) | null = null;
+
+    const stream = new ReadableStream<Uint8Array>({
+        start(controller) {
+            unsubscribe = subscribe((event) => {
+                if (
+                    event.type === 'server-state' ||
+                    event.type === 'deployment-opened' ||
+                    event.type === 'server-changed' ||
+                    event.type === 'sweep-tick'
+                ) {
+                    send(controller, event);
+                }
+            });
+            controller.enqueue(encoder.encode(': hello\n\n'));
+            heartbeat = setInterval(() => controller.enqueue(encoder.encode(': ping\n\n')), HEARTBEAT_MS);
+        },
+        cancel() {
+            if (heartbeat) clearInterval(heartbeat);
+            if (unsubscribe) unsubscribe();
+        }
+    });
+
+    return new Response(stream, {
+        headers: {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache, no-transform',
+            Connection: 'keep-alive'
+        }
+    });
+}

src/routes/api/events/servers/+server.ts

@@ -0,0 +1,33 @@
+import { subscribe } from '$lib/server/pipeline/bus.js';
+
+const encoder = new TextEncoder();
+const HEARTBEAT_MS = 20_000;
+
+export async function GET() {
+    let heartbeat: NodeJS.Timeout | null = null;
+    let unsubscribe: (() => void) | null = null;
+
+    const stream = new ReadableStream<Uint8Array>({
+        start(controller) {
+            unsubscribe = subscribe((event) => {
+                if (event.type === 'server-status') {
+                    controller.enqueue(encoder.encode(`event: server-status\ndata: ${JSON.stringify(event)}\n\n`));
+                }
+            });
+            controller.enqueue(encoder.encode(': hello\n\n'));
+            heartbeat = setInterval(() => controller.enqueue(encoder.encode(': ping\n\n')), HEARTBEAT_MS);
+        },
+        cancel() {
+            if (heartbeat) clearInterval(heartbeat);
+            if (unsubscribe) unsubscribe();
+        }
+    });
+
+    return new Response(stream, {
+        headers: {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache, no-transform',
+            Connection: 'keep-alive'
+        }
+    });
+}

src/routes/api/push/+server.ts

@@ -0,0 +1,21 @@
+import { json } from '@sveltejs/kit';
+import { doPush } from '$lib/server/fleet/push.js';
+import { kick } from '$lib/server/pipeline/worker.js';
+
+export async function POST({ request }: { request: Request }) {
+    const body = (await request.json().catch(() => ({}))) as {
+        patterns?: string[];
+        dryRun?: boolean;
+        delete?: boolean;
+        create?: boolean;
+    };
+    const result = await doPush({
+        patterns: body.patterns ?? ['*'],
+        dryRun: body.dryRun ?? false,
+        delete: body.delete ?? false,
+        create: body.create ?? false,
+        triggeredBy: 'ui'
+    });
+    if (result.deploymentId) void kick();
+    return json(result);
+}

src/routes/api/servers/+server.ts

@@ -0,0 +1,10 @@
+import { json } from '@sveltejs/kit';
+import { listServers, heldByBeta } from '$lib/server/fleet/servers.js';
+
+export async function GET() {
+    const servers = listServers().map((s) => ({
+        ...s,
+        held: [...heldByBeta(s.name).entries()].map(([target, slug]) => ({ target, slug }))
+    }));
+    return json({ servers });
+}