Function boot

showcase/harness/src/orchestrator.ts:374–1365

(opts: BootOptions = {})

}

export async function boot(opts: BootOptions = {}): Promise<{
  stop: () => Promise<void>;
  port: number;
  /**
   * Exposed for tests (R21 bucket-a): subscribers can observe
   * `rules.reload.failed` etc. without reaching into module-private state.
   * Production callers should not rely on this — it's an escape hatch and
   * may tighten in the future.
   */
  bus: ReturnType<typeof createEventBus>;
}> {
  // R1-F2: hoist all fail-loud config validation to the TOP of boot() —
  // BEFORE any pb client / bus / scheduler / writer / S3 uploader allocations.
  // Pre-fix `loadWebhookSecrets` lived AFTER the entire scheduler+writer
  // setup, and `POCKETBASE_URL` had a narrower predicate than SHARED_SECRET
  // (only NODE_ENV=production), so a misconfigured staging boot allocated
  // expensive resources, mounted file watchers, and registered scheduler
  // entries before throwing. Now both checks fire here, before anything that
  // would need teardown.
  //
  // R1-F3: `loadPocketbaseUrl` replaces the inline production-only guard
  // with the same test-or-escape-hatch predicate `loadWebhookSecrets` uses,
  // so staging/development/unset NODE_ENV fail loud on BOTH config misses
  // instead of just SHARED_SECRET.
  //
  // R3-F1: hoist `OPS_TRIGGER_TOKEN` set-but-empty fail-loud here too.
  // Pre-fix this check lived AFTER pb / bus / scheduler / writer / S3
  // uploader allocations, so a typo'd `OPS_TRIGGER_TOKEN=` allocated
  // expensive resources before throwing. Now all three fail-loud config
  // predicates fire at the top, before anything that would need teardown.
  const pbUrl = loadPocketbaseUrl(logger);
  const webhookSecrets = loadWebhookSecrets(logger);
  const triggerToken = loadOpsTriggerToken(logger);
  // These authenticate against `/api/collections/_superusers/auth-with-password`
  // in pb-client, so the env var names intentionally mirror "superuser" —
  // previously `POCKETBASE_WRITER_*`, renamed to eliminate the naming drift
  // between auth endpoint and env contract.
  const email = process.env.POCKETBASE_SUPERUSER_EMAIL;
  const password = process.env.POCKETBASE_SUPERUSER_PASSWORD;

  const pb = createPbClient({ url: pbUrl, email, password, logger });
  const bus = createEventBus();
  const renderer = createRenderer();
  const stateStore = createAlertStateStore(pb);
  // Writer identity: this is the legacy monolith scheduler's writer — the
  // identity the cross-writer flip warn attributes legacy-vs-fleet fights to.
  const writer = createStatusWriter({ pb, bus, logger, writtenBy: "legacy" });
  const scheduler = createScheduler({ logger });
  const metrics = createMetricsRegistry();

  // Track all bus subscriptions so stop() can release them on repeated boot/stop.
  const busUnsubs: Array<() => void> = [];

  // Observability: increment counters on bus events so /metrics stays fresh.
  busUnsubs.push(bus.on("rules.reloaded", () => metrics.inc("rule_reloads")));
  // Ticks once per `status.changed` emit. NOT strictly 1:1 with probe runs:
  // besides each successfully-written durable result, an ERROR tick whose
  // observed_at refresh persisted on an existing row also emits