@crossdelta/infrastructure 0.7.6 → 0.8.1

package/README.md

@@ -28,6 +28,7 @@ const config: K8sServiceConfig = {
   },
   ingress: { path: '/api', host: 'example.com' },
   env: { DATABASE_URL: dbUrl },
+  containerEnv: { NODE_OPTIONS: '--max-old-space-size=384' },
   secrets: { API_KEY: apiKey },
   resources: {
     requests: { cpu: '50m', memory: '64Mi' },
@@ -95,6 +96,7 @@ interface K8sServiceConfig {
     host?: string
   }
   env?: Record<string, pulumi.Input<string>>
+  containerEnv?: Record<string, pulumi.Input<string>>
   secrets?: Record<string, pulumi.Input<string>>
   image?: string
   skip?: boolean

package/bin/generate-env.mjs

@@ -4,6 +4,7 @@
 import { execSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+var LOCK_FILES = ["bun.lock", "bun.lockb", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"];
 var toEnvKey = (name) => name.toUpperCase().replace(/-/g, "_");
 var resolveNumber = (value, fileContent) => {
   const literal = Number.parseInt(value, 10);
@@ -22,28 +23,84 @@ var extract = {
     const match = content.match(pattern)?.[1];
     if (!match)
       return;
-    const numbers = match.split(",").map((v) => resolveNumber(v.trim(), content)).filter((n) => n !== undefined);
+    const numbers = match.split(",").map((value) => resolveNumber(value.trim(), content)).filter((num) => num !== undefined);
     return numbers.length > 0 ? numbers : undefined;
   }
 };
-var LOCK_FILES = ["bun.lock", "bun.lockb", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"];
-var hasLockFile = (dir) => LOCK_FILES.some((file) => existsSync(join(dir, file)));
+var extractEnvLiterals = (content) => {
+  const envBlockMatch = content.match(/(?<!\w)env:\s*\{([^}]*(?:\{[^}]*\}[^}]*)*)\}/);
+  if (!envBlockMatch?.[1])
+    return;
+  const literals = {};
+  const literalPattern = /^\s*(\w+):\s*['"]([^'"]+)['"]/gm;
+  for (const [, key, value] of envBlockMatch[1].matchAll(literalPattern)) {
+    if (key && value)
+      literals[key] = value;
+  }
+  return Object.keys(literals).length > 0 ? literals : undefined;
+};
+var getServicePort = (config) => {
+  if (config.primaryPort)
+    return config.primaryPort;
+  if (config.containerPort)
+    return config.containerPort;
+  if (config.httpPort)
+    return config.httpPort;
+  if (config.internalPorts?.[0])
+    return config.internalPorts[0];
+  return;
+};
+var getLocalUrl = (config) => {
+  const port = getServicePort(config);
+  if (!port)
+    return;
+  if (config.internalUrl) {
+    const protocolMatch = config.internalUrl.match(/^(\w+):\/\//);
+    if (protocolMatch) {
+      return `${protocolMatch[1]}://localhost:${port}`;
+    }
+  }
+  return `http://localhost:${port}`;
+};
+var buildServiceEnvLines = (serviceConfigs) => {
+  const lines = [];
+  lines.push("", "# Service URLs");
+  for (const config of serviceConfigs) {
+    const url = getLocalUrl(config);
+    if (url)
+      lines.push(`${toEnvKey(config.name)}_URL=${url}`);
+  }
+  lines.push("", "# Service Ports");
+  for (const config of serviceConfigs) {
+    const port = getServicePort(config);
+    if (port)
+      lines.push(`${toEnvKey(config.name)}_PORT=${port}`);
+  }
+  const envLiteralConfigs = serviceConfigs.filter((config) => config.envLiterals !== undefined);
+  if (envLiteralConfigs.length > 0) {
+    lines.push("", "# Service Environment");
+    for (const config of envLiteralConfigs) {
+      for (const [key, value] of Object.entries(config.envLiterals)) {
+        lines.push(`${key}=${value}`);
+      }
+    }
+  }
+  return lines;
+};
+var hasLockFile = (directory) => LOCK_FILES.some((file) => existsSync(join(directory, file)));
 var findWorkspaceRoot = () => {
-  let dir = process.cwd();
-  while (!hasLockFile(dir)) {
-    const parent = join(dir, "..");
-    if (parent === dir)
+  let directory = process.cwd();
+  while (!hasLockFile(directory)) {
+    const parent = join(directory, "..");
+    if (parent === directory)
       throw new Error("Could not locate workspace root");
-    dir = parent;
+    directory = parent;
   }
-  return dir;
+  return directory;
 };
-var loadPulumiConfig = async (infraDir, stack) => {
+var loadPulumiConfig = async (infraDirectory, stack) => {
   try {
-    const stdout = execSync(`pulumi config --show-secrets --json --stack ${stack} --cwd ${infraDir}`, {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
+    const stdout = execSync(`pulumi config --show-secrets --json --stack ${stack} --cwd ${infraDirectory}`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
     const config = JSON.parse(stdout);
     return Object.entries(config).filter(([key]) => key.includes(":")).filter(([, entry]) => entry.value !== undefined && entry.value !== null && entry.value !== "undefined").map(([fullKey, entry]) => {
       const [, rawKey] = fullKey.split(":");
@@ -53,12 +110,12 @@ var loadPulumiConfig = async (infraDir, stack) => {
     return [];
   }
 };
-var discoverServices = (servicesDir) => {
-  if (!existsSync(servicesDir))
+var discoverServices = (servicesDirectory) => {
+  if (!existsSync(servicesDirectory))
     return [];
-  const files = readdirSync(servicesDir).filter((file) => file.endsWith(".ts") && file !== "index.ts");
+  const files = readdirSync(servicesDirectory).filter((file) => file.endsWith(".ts") && file !== "index.ts");
   return files.map((file) => {
-    const content = readFileSync(join(servicesDir, file), "utf-8");
+    const content = readFileSync(join(servicesDirectory, file), "utf-8");
     const portsApiMatch = content.match(/ports\(\)\.(?:http|https|grpc|primary)\((\d+)\)/) || content.match(/ports\(\)\.add\((\d+)/);
     return {
       name: extract.string(content, /name:\s*['"]([^'"]+)['"]/) ?? file.replace(".ts", ""),
@@ -66,68 +123,33 @@ var discoverServices = (servicesDir) => {
       containerPort: extract.number(content, /containerPort:\s*(\w+)/),
       httpPort: extract.number(content, /httpPort:\s*(\w+)/),
       internalPorts: extract.numberArray(content, /internalPorts:\s*\[([^\]]+)\]/),
-      internalUrl: extract.string(content, /internalUrl:\s*[`'"]([^`'"]+)[`'"]/)
+      internalUrl: extract.string(content, /internalUrl:\s*[`'"]([^`'"]+)[`'"]/),
+      envLiterals: extractEnvLiterals(content)
     };
   });
 };
-var getServicePort = (config) => {
-  if (config.primaryPort)
-    return config.primaryPort;
-  if (config.containerPort)
-    return config.containerPort;
-  if (config.httpPort)
-    return config.httpPort;
-  if (config.internalPorts?.[0])
-    return config.internalPorts[0];
-  return;
-};
-var getLocalUrl = (config) => {
-  const port = getServicePort(config);
-  if (!port)
-    return;
-  if (config.internalUrl) {
-    const protocolMatch = config.internalUrl.match(/^(\w+):\/\//);
-    if (protocolMatch) {
-      return `${protocolMatch[1]}://localhost:${port}`;
-    }
-  }
-  return `http://localhost:${port}`;
-};
 var main = async () => {
   const noPulumi = process.argv.includes("--no-pulumi");
-  const workspaceRootDir = findWorkspaceRoot();
-  const infraDir = join(workspaceRootDir, "infra");
-  const servicesDir = join(infraDir, "services");
+  const workspaceRootDirectory = findWorkspaceRoot();
+  const infraDirectory = join(workspaceRootDirectory, "infra");
+  const servicesDirectory = join(infraDirectory, "services");
   const envLines = ["# Generated .env.local"];
-  if (!noPulumi && existsSync(join(infraDir, "Pulumi.yaml"))) {
-    const pulumiEnvs = await loadPulumiConfig(infraDir, "dev");
-    if (pulumiEnvs.length > 0) {
+  if (!noPulumi && existsSync(join(infraDirectory, "Pulumi.yaml"))) {
+    const pulumiEntries = await loadPulumiConfig(infraDirectory, "dev");
+    if (pulumiEntries.length > 0) {
       envLines.push("", "# Pulumi Secrets");
-      envLines.push(...pulumiEnvs);
+      envLines.push(...pulumiEntries);
     }
   }
-  const serviceConfigs = discoverServices(servicesDir);
+  const serviceConfigs = discoverServices(servicesDirectory);
   if (serviceConfigs.length > 0) {
-    envLines.push("", "# Service URLs");
-    for (const config of serviceConfigs) {
-      const url = getLocalUrl(config);
-      if (url) {
-        envLines.push(`${toEnvKey(config.name)}_URL=${url}`);
-      }
-    }
-    envLines.push("", "# Service Ports");
-    for (const config of serviceConfigs) {
-      const port = getServicePort(config);
-      if (port) {
-        envLines.push(`${toEnvKey(config.name)}_PORT=${port}`);
-      }
-    }
+    envLines.push(...buildServiceEnvLines(serviceConfigs));
     console.log(`✅ Discovered ${serviceConfigs.length} services`);
   }
-  writeFileSync(join(workspaceRootDir, ".env.local"), `${envLines.join(`
+  writeFileSync(join(workspaceRootDirectory, ".env.local"), `${envLines.join(`
 `)}
 `);
-  console.log(`✅ .env.local generated at ${workspaceRootDir}`);
+  console.log(`✅ .env.local generated at ${workspaceRootDirectory}`);
 };
 main().catch((err) => {
   console.error("❌", err.message);

package/bin/generate-env.ts

@@ -26,8 +26,11 @@ interface MinimalServiceConfig {
   httpPort?: number
   internalPorts?: number[]
   internalUrl?: string
+  envLiterals?: Record<string, string>
 }
 
+const LOCK_FILES = ['bun.lock', 'bun.lockb', 'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml']
+
 const toEnvKey = (name: string): string => name.toUpperCase().replace(/-/g, '_')
 
 const resolveNumber = (value: string, fileContent: string): number | undefined => {
@@ -52,33 +55,97 @@ const extract = {
 
     const numbers = match
       .split(',')
-      .map((v) => resolveNumber(v.trim(), content))
-      .filter((n): n is number => n !== undefined)
+      .map((value) => resolveNumber(value.trim(), content))
+      .filter((num): num is number => num !== undefined)
 
     return numbers.length > 0 ? numbers : undefined
   },
 }
 
-const LOCK_FILES = ['bun.lock', 'bun.lockb', 'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml']
+const extractEnvLiterals = (content: string): Record<string, string> | undefined => {
+  const envBlockMatch = content.match(/(?<!\w)env:\s*\{([^}]*(?:\{[^}]*\}[^}]*)*)\}/)
+  if (!envBlockMatch?.[1]) return undefined
+
+  const literals: Record<string, string> = {}
+  const literalPattern = /^\s*(\w+):\s*['"]([^'"]+)['"]/gm
+  for (const [, key, value] of envBlockMatch[1].matchAll(literalPattern)) {
+    if (key && value) literals[key] = value
+  }
+  return Object.keys(literals).length > 0 ? literals : undefined
+}
+
+const getServicePort = (config: MinimalServiceConfig): number | undefined => {
+  if (config.primaryPort) return config.primaryPort
+  if (config.containerPort) return config.containerPort
+  if (config.httpPort) return config.httpPort
+  if (config.internalPorts?.[0]) return config.internalPorts[0]
+  return undefined
+}
+
+const getLocalUrl = (config: MinimalServiceConfig): string | undefined => {
+  const port = getServicePort(config)
+  if (!port) return undefined
 
-const hasLockFile = (dir: string): boolean => LOCK_FILES.some((file) => existsSync(join(dir, file)))
+  if (config.internalUrl) {
+    const protocolMatch = config.internalUrl.match(/^(\w+):\/\//)
+    if (protocolMatch) {
+      return `${protocolMatch[1]}://localhost:${port}`
+    }
+  }
+
+  return `http://localhost:${port}`
+}
+
+const buildServiceEnvLines = (serviceConfigs: MinimalServiceConfig[]): string[] => {
+  const lines: string[] = []
+
+  lines.push('', '# Service URLs')
+  for (const config of serviceConfigs) {
+    const url = getLocalUrl(config)
+    if (url) lines.push(`${toEnvKey(config.name)}_URL=${url}`)
+  }
+
+  lines.push('', '# Service Ports')
+  for (const config of serviceConfigs) {
+    const port = getServicePort(config)
+    if (port) lines.push(`${toEnvKey(config.name)}_PORT=${port}`)
+  }
+
+  const envLiteralConfigs = serviceConfigs.filter(
+    (config): config is MinimalServiceConfig & { envLiterals: Record<string, string> } =>
+      config.envLiterals !== undefined,
+  )
+  if (envLiteralConfigs.length > 0) {
+    lines.push('', '# Service Environment')
+    for (const config of envLiteralConfigs) {
+      for (const [key, value] of Object.entries(config.envLiterals)) {
+        lines.push(`${key}=${value}`)
+      }
+    }
+  }
+
+  return lines
+}
+
+const hasLockFile = (directory: string): boolean =>
+  LOCK_FILES.some((file) => existsSync(join(directory, file)))
 
 const findWorkspaceRoot = (): string => {
-  let dir = process.cwd()
-  while (!hasLockFile(dir)) {
-    const parent = join(dir, '..')
-    if (parent === dir) throw new Error('Could not locate workspace root')
-    dir = parent
+  let directory = process.cwd()
+  while (!hasLockFile(directory)) {
+    const parent = join(directory, '..')
+    if (parent === directory) throw new Error('Could not locate workspace root')
+    directory = parent
   }
-  return dir
+  return directory
 }
 
-const loadPulumiConfig = async (infraDir: string, stack: string): Promise<string[]> => {
+const loadPulumiConfig = async (infraDirectory: string, stack: string): Promise<string[]> => {
   try {
-    const stdout = execSync(`pulumi config --show-secrets --json --stack ${stack} --cwd ${infraDir}`, {
-      encoding: 'utf-8',
-      stdio: ['pipe', 'pipe', 'pipe'],
-    })
+    const stdout = execSync(
+      `pulumi config --show-secrets --json --stack ${stack} --cwd ${infraDirectory}`,
+      { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] },
+    )
 
     const config = JSON.parse(stdout) as Record<string, PulumiConfigEntry>
 
@@ -94,15 +161,15 @@ const loadPulumiConfig = async (infraDir: string, stack: string): Promise<string
   }
 }
 
-const discoverServices = (servicesDir: string): MinimalServiceConfig[] => {
-  if (!existsSync(servicesDir)) return []
+const discoverServices = (servicesDirectory: string): MinimalServiceConfig[] => {
+  if (!existsSync(servicesDirectory)) return []
 
-  const files = readdirSync(servicesDir).filter((file) => file.endsWith('.ts') && file !== 'index.ts')
+  const files = readdirSync(servicesDirectory).filter((file) => file.endsWith('.ts') && file !== 'index.ts')
 
   return files.map((file) => {
-    const content = readFileSync(join(servicesDir, file), 'utf-8')
+    const content = readFileSync(join(servicesDirectory, file), 'utf-8')
 
-    // Extract port from new ports() API: ports().http(4001) or ports().primary(4222)
+    // Extract port from ports() API: ports().http(4001) or ports().primary(4222)
     const portsApiMatch =
       content.match(/ports\(\)\.(?:http|https|grpc|primary)\((\d+)\)/) ||
       content.match(/ports\(\)\.add\((\d+)/)
@@ -114,74 +181,35 @@ const discoverServices = (servicesDir: string): MinimalServiceConfig[] => {
       httpPort: extract.number(content, /httpPort:\s*(\w+)/),
       internalPorts: extract.numberArray(content, /internalPorts:\s*\[([^\]]+)\]/),
       internalUrl: extract.string(content, /internalUrl:\s*[`'"]([^`'"]+)[`'"]/),
+      envLiterals: extractEnvLiterals(content),
     }
   })
 }
 
-const getServicePort = (config: MinimalServiceConfig): number | undefined => {
-  if (config.primaryPort) return config.primaryPort // New ports() API
-  if (config.containerPort) return config.containerPort
-  if (config.httpPort) return config.httpPort
-  if (config.internalPorts?.[0]) return config.internalPorts[0]
-  return undefined
-}
-
-const getLocalUrl = (config: MinimalServiceConfig): string | undefined => {
-  const port = getServicePort(config)
-  if (!port) return undefined
-
-  if (config.internalUrl) {
-    const protocolMatch = config.internalUrl.match(/^(\w+):\/\//)
-    if (protocolMatch) {
-      return `${protocolMatch[1]}://localhost:${port}`
-    }
-  }
-
-  return `http://localhost:${port}`
-}
-
 const main = async () => {
   const noPulumi = process.argv.includes('--no-pulumi')
-  const workspaceRootDir = findWorkspaceRoot()
-  const infraDir = join(workspaceRootDir, 'infra')
-  const servicesDir = join(infraDir, 'services')
-
+  const workspaceRootDirectory = findWorkspaceRoot()
+  const infraDirectory = join(workspaceRootDirectory, 'infra')
+  const servicesDirectory = join(infraDirectory, 'services')
   const envLines: string[] = ['# Generated .env.local']
 
-  // Load Pulumi secrets if available and not disabled
-  if (!noPulumi && existsSync(join(infraDir, 'Pulumi.yaml'))) {
-    const pulumiEnvs = await loadPulumiConfig(infraDir, 'dev')
-    if (pulumiEnvs.length > 0) {
+  if (!noPulumi && existsSync(join(infraDirectory, 'Pulumi.yaml'))) {
+    const pulumiEntries = await loadPulumiConfig(infraDirectory, 'dev')
+    if (pulumiEntries.length > 0) {
       envLines.push('', '# Pulumi Secrets')
-      envLines.push(...pulumiEnvs)
+      envLines.push(...pulumiEntries)
     }
   }
 
-  // Discover services
-  const serviceConfigs = discoverServices(servicesDir)
-
+  const serviceConfigs = discoverServices(servicesDirectory)
+  
   if (serviceConfigs.length > 0) {
-    envLines.push('', '# Service URLs')
-    for (const config of serviceConfigs) {
-      const url = getLocalUrl(config)
-      if (url) {
-        envLines.push(`${toEnvKey(config.name)}_URL=${url}`)
-      }
-    }
-
-    envLines.push('', '# Service Ports')
-    for (const config of serviceConfigs) {
-      const port = getServicePort(config)
-      if (port) {
-        envLines.push(`${toEnvKey(config.name)}_PORT=${port}`)
-      }
-    }
-
+    envLines.push(...buildServiceEnvLines(serviceConfigs))
     console.log(`✅ Discovered ${serviceConfigs.length} services`)
   }
 
-  writeFileSync(join(workspaceRootDir, '.env.local'), `${envLines.join('\n')}\n`)
-  console.log(`✅ .env.local generated at ${workspaceRootDir}`)
+  writeFileSync(join(workspaceRootDirectory, '.env.local'), `${envLines.join('\n')}\n`)
+  console.log(`✅ .env.local generated at ${workspaceRootDirectory}`)
 }
 
 main().catch((err) => {

package/dist/index.cjs

@@ -1266,10 +1266,10 @@ var createImagePullSecret = (provider, namespace, name, config) => {
 var getImagePullPolicy = (image, explicit) => explicit ?? (image.endsWith(":latest") ? "Always" : "IfNotPresent");
 var buildEnvVars = (config) => {
   const portEnv = { name: "PORT", value: String(config.ports.primary.port) };
-  const plainEnvVars = config.env ? Object.entries(config.env).map(([key, value]) => ({
+  const plainEnvVars = [...Object.entries(config.env ?? {}), ...Object.entries(config.containerEnv ?? {})].map(([key, value]) => ({
     name: key,
     value: pulumi6.output(value)
-  })) : [];
+  }));
   const secretEnvVars = config.secrets ? Object.keys(config.secrets).map((key) => ({
     name: key,
     valueFrom: {
@@ -1435,6 +1435,13 @@ var deployK8sService = (provider, namespace, config) => {
     },
     spec: {
       replicas,
+      strategy: {
+        type: "RollingUpdate",
+        rollingUpdate: {
+          maxSurge: normalizedConfig.strategy?.maxSurge ?? 0,
+          maxUnavailable: normalizedConfig.strategy?.maxUnavailable ?? 1
+        }
+      },
       selector: {
         matchLabels: { app: normalizedConfig.name }
       },

package/dist/index.js

@@ -1172,10 +1172,10 @@ var createImagePullSecret = (provider, namespace, name, config) => {
 var getImagePullPolicy = (image, explicit) => explicit ?? (image.endsWith(":latest") ? "Always" : "IfNotPresent");
 var buildEnvVars = (config) => {
   const portEnv = { name: "PORT", value: String(config.ports.primary.port) };
-  const plainEnvVars = config.env ? Object.entries(config.env).map(([key, value]) => ({
+  const plainEnvVars = [...Object.entries(config.env ?? {}), ...Object.entries(config.containerEnv ?? {})].map(([key, value]) => ({
     name: key,
     value: pulumi6.output(value)
-  })) : [];
+  }));
   const secretEnvVars = config.secrets ? Object.keys(config.secrets).map((key) => ({
     name: key,
     valueFrom: {
@@ -1341,6 +1341,13 @@ var deployK8sService = (provider, namespace, config) => {
     },
     spec: {
       replicas,
+      strategy: {
+        type: "RollingUpdate",
+        rollingUpdate: {
+          maxSurge: normalizedConfig.strategy?.maxSurge ?? 0,
+          maxUnavailable: normalizedConfig.strategy?.maxUnavailable ?? 1
+        }
+      },
       selector: {
         matchLabels: { app: normalizedConfig.name }
       },

package/dist/runtimes/doks/types.d.ts

@@ -244,8 +244,10 @@ export interface K8sServiceConfig {
     containerPort?: number;
     /** Number of replicas (defaults to 1) */
     replicas?: number;
-    /** Environment variables (plain values) */
+    /** Environment variables (plain values, available locally and in containers) */
     env?: Record<string, pulumi.Input<string>>;
+    /** Environment variables applied only inside the container (excluded from generate-env) */
+    containerEnv?: Record<string, pulumi.Input<string>>;
     /** Secret environment variables (stored in K8s Secret) */
     secrets?: Record<string, pulumi.Input<string>>;
     /** Ingress configuration (set to enable public access) */
@@ -254,6 +256,18 @@ export interface K8sServiceConfig {
     healthCheck?: K8sHealthCheck;
     /** Resource requests and limits */
     resources?: K8sResourceConfig;
+    /**
+     * Deployment strategy for rolling updates.
+     *
+     * Defaults to `maxSurge: 0, maxUnavailable: 1` which avoids memory spikes
+     * during rollouts by replacing pods one-at-a-time without surge.
+     */
+    strategy?: {
+        /** Max extra pods during rollout (default: 0) */
+        maxSurge?: number;
+        /** Max unavailable pods during rollout (default: 1) */
+        maxUnavailable?: number;
+    };
     /** Volume mounts for persistent storage */
     volumes?: K8sVolumeMount[];
     /** Command to run (overrides container entrypoint) */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crossdelta/infrastructure",
-  "version": "0.7.6",
+  "version": "0.8.1",
   "type": "module",
   "license": "MIT",
   "publishConfig": {
@@ -35,7 +35,7 @@
     }
   },
   "dependencies": {
-    "@crossdelta/cloudevents": "0.7.8"
+    "@crossdelta/cloudevents": "^0.7.14"
   },
   "peerDependencies": {
     "@pulumi/digitalocean": "^4.0.0",