@vibesdotdev/infra-cloudflare 0.0.1

package/README.md

@@ -0,0 +1,107 @@
+# @vibesdotdev/infra-cloudflare
+
+Cloudflare slice of the vibes deployment toolkit. Generates wrangler-shaped
+config fragments for Cloudflare Workers, Queues, R2, and KV, and registers a
+write-only `secrets/store` backend that pushes secrets to Cloudflare via the
+v4 REST API.
+
+See [`SPEC.md`](./SPEC.md) for the contract and
+[`PROD-CHECKLIST.md`](./PROD-CHECKLIST.md) for verification status.
+
+## What's in here
+
+- `src/cloudflare.plugin.ts` — `cloudflarePlugin` registers loaders against
+  `infra/worker`, `infra/queue`, `infra/object-storage`, `infra/cache`, and
+  `secrets/store` kinds owned by [`infra-core`](../infra-core/SPEC.md) and
+  [`secrets`](../secrets/SPEC.md).
+- `src/implementations/workers.impl.ts` —
+  `generateCloudflareWorkerConfig` plus the cloud Flow job-consumer
+  convention (`generateJobConsumerWorkerConfig`,
+  `JOB_RESULT_STORE_BINDING` / `_CLASS` / `_INITIAL_MIGRATION_TAG`).
+- `src/implementations/queues.impl.ts` — Cloudflare Queues producer
+  bindings.
+- `src/implementations/r2.impl.ts` — R2 bucket bindings (preview buckets,
+  jurisdiction).
+- `src/implementations/kv.impl.ts` — KV namespace bindings (preview ids).
+- `src/secrets/` — `cloudflareApiDescriptor` + `createCloudflareApiStore`
+  (push-only `secrets/store`) and the raw v4 client helpers.
+
+## Common usage
+
+Register the plugin alongside `infraPlugin` during runtime bootstrap:
+
+```ts
+import { createVibesRuntime } from '@vibesdotdev/runtime';
+import infraPlugin from '@vibesdotdev/infra-core/plugin';
+import cloudflarePlugin from '@vibesdotdev/infra-cloudflare/plugin';
+
+const runtime = createVibesRuntime({
+  plugins: [infraPlugin, cloudflarePlugin]
+});
+```
+
+Generate a worker config from a descriptor:
+
+```ts
+import { generateCloudflareWorkerConfig } from '@vibesdotdev/infra-cloudflare/implementations/workers';
+
+const config = generateCloudflareWorkerConfig({
+  kind: 'infra/worker',
+  id: 'billing',
+  name: 'Billing Worker',
+  adapter: 'cloudflare-workers',
+  workerName: 'vibes-billing-worker',
+  main: 'src/worker.ts',
+  consumers: [{ queue: 'billing-jobs' }],
+  kvNamespaces: [{ binding: 'CACHE', id: 'abc123' }]
+});
+```
+
+Generate a cloud Flow job-consumer worker (auto-injects the
+`JOB_RESULT_STORE` Durable Object binding + initial SQLite migration the
+[`workers`](../workers/SPEC.md) rendezvous protocol expects):
+
+```ts
+import { generateJobConsumerWorkerConfig } from '@vibesdotdev/infra-cloudflare/implementations/workers';
+
+const config = generateJobConsumerWorkerConfig({
+  kind: 'infra/worker',
+  id: 'flow-consumer',
+  name: 'Flow Consumer',
+  adapter: 'cloudflare-workers',
+  workerName: 'vibes-flow-consumer',
+  main: 'src/worker.ts',
+  consumers: [{ queue: 'flow-jobs' }]
+});
+```
+
+Push secrets via the Cloudflare API backend (requires
+`CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID` in the environment):
+
+```ts
+import { createCloudflareApiStore } from '@vibesdotdev/infra-cloudflare';
+
+const store = createCloudflareApiStore();
+await store.impl.setAll('production', {
+  STRIPE_SECRET_KEY: '...',
+  RESEND_API_KEY: '...'
+});
+```
+
+## Verification
+
+```bash
+cd packages/infra-cloudflare
+bun test
+bun --bun tsc -p tsconfig.json --noEmit
+```
+
+## Links
+
+- [SPEC.md](./SPEC.md)
+- [PROD-CHECKLIST.md](./PROD-CHECKLIST.md)
+- [`infra-core`](../infra-core/SPEC.md)
+- [`infra-doks`](../infra-doks/SPEC.md)
+- [`secrets`](../secrets/SPEC.md)
+- [`workers`](../workers/SPEC.md)
+- [`deploy`](../deploy/SPEC.md)

package/SPEC.md

@@ -0,0 +1,166 @@
+# @vibesdotdev/infra-cloudflare
+
+Cloudflare adapter for [`infra-core`](../infra-core/SPEC.md) kinds. Provides the
+Cloudflare slice of the vibes deployment toolkit: generates wrangler-shaped
+config fragments for Cloudflare Workers, Queues, R2, and KV, and registers a
+write-only `secrets/store` backend that pushes secrets to Cloudflare Pages
+projects and Workers scripts via the v4 REST API. Consumed by per-app
+`deployment.config.ts` files (and `infra/manifest.ts` / `infra/generate.ts`)
+inside this monorepo, and intended to be consumed by end-user vibes projects
+that target Cloudflare. Pairs with [`infra-doks`](../infra-doks/SPEC.md) on the
+DigitalOcean side.
+
+## Owns
+
+- **Plugin descriptors registered by the plugin:** `cloudflarePlugin`
+  (id `infra-cloudflare`, depends on `infra`) registers loaders for:
+  - `infra/worker` → `cloudflare-workers`
+  - `infra/queue` → `cloudflare-queues`
+  - `infra/object-storage` → `cloudflare-r2`
+  - `infra/cache` → `cloudflare-kv`
+  - `secrets/store` → `cloudflare-api` (priority 20)
+- **Worker config generator** (`./implementations/workers`):
+  `generateCloudflareWorkerConfig` plus the cloud Flow job-consumer
+  convention (`generateJobConsumerWorkerConfig`,
+  `JOB_RESULT_STORE_BINDING` / `_CLASS` / `_INITIAL_MIGRATION_TAG`). Emits a
+  wrangler-shaped object: `name`, `main`, compatibility, `vars`, `queues`,
+  `kv_namespaces`, `r2_buckets`, `durable_objects`, `migrations`, optional
+  smart placement.
+- **Web-app wrangler.jsonc generator** (`./implementations/web-app`):
+  `createCloudflareWebAppDeployment({ ... }).generateWranglerConfig()` is the
+  authoritative emitter for SvelteKit/SSR apps. Supports every wrangler key
+  currently in use across the repo: `name`, `main`, `compatibility_date`,
+  `compatibility_flags`, `assets`, `routes`, `vars`, `secrets_store_secrets`,
+  `secrets.required`, `d1_databases`, `r2_buckets`, `services`,
+  `observability`, `triggers`, `queues`, `durable_objects`, `migrations`,
+  `send_email`, `workers_dev`, `preview_urls`. `apps/<name>/wrangler.jsonc`
+  is a build artifact regenerated from `deployment.config.ts` by
+  `vibes infra deploy regenerate` (the sole supported path).
+  CI drift is enforced via the CLI `--check`. To adopt: express the surface in
+  `deployment.config.ts`, run `vibes infra deploy regenerate --adopt --path <dir>`.
+- **Queue producer config generator** (`./implementations/queues`):
+  `generateCloudflareQueueConfig` for `infra/queue` when
+  `engine === 'cloudflare-queues'`.
+- **R2 bucket config generator** (`./implementations/r2`):
+  `generateCloudflareR2Config` for `infra/object-storage` when
+  `adapter === 'cloudflare-r2'`. Supports preview buckets and jurisdiction.
+- **KV namespace config generator** (`./implementations/kv`):
+  `generateCloudflareKVConfig` for `infra/cache` when
+  `engine === 'cloudflare-kv'`. Supports preview namespaces.
+- **Cloudflare API secrets backend** (`./src/secrets/`):
+  `cloudflareApiDescriptor` + `createCloudflareApiStore` register a
+  push-only `secrets/store` against CF Pages project `env_vars` and Worker
+  script `secrets`, plus the raw client helpers (`listPagesSecrets`,
+  `setPagesSecrets`, `listWorkerSecrets`, `setWorkerSecrets`).
+
+## Does not own
+
+- The kind contracts themselves (descriptor schema shapes for `infra/*` and
+  `secrets/store`) → [`infra-core`](../infra-core/SPEC.md) and
+  [`secrets`](../secrets/SPEC.md). This package only registers
+  implementations against those kinds.
+- DigitalOcean / DOKS / Spaces / Managed DB equivalents →
+  [`infra-doks`](../infra-doks/SPEC.md).
+- Deployment orchestration, manifest generation, env materialization →
+  [`deploy`](../deploy/SPEC.md). Per-app `deployment.config.ts` lives in
+  the consuming app.
+- Local / encrypted / env-file secret backends →
+  [`secrets`](../secrets/SPEC.md).
+
+## Hard rules
+
+- This package implements adapters; it never declares new runtime kinds.
+  New kinds belong in [`infra-core`](../infra-core/SPEC.md).
+- Pure TypeScript and global `fetch`. No Node-only APIs, no filesystem, no
+  `wrangler` CLI dependency. Generators return plain objects callers can
+  serialize to wrangler.jsonc.
+- The `cloudflare-api` secrets store is push-only. `get` / `getAll` always
+  return empty/undefined and `unset` is a no-op (Cloudflare does not return
+  secret values or expose per-key delete). Callers that round-trip through
+  `get` are broken; reads must come from a different backend.
+- `cloudflareApiDescriptor.tiers` is `['staging', 'production']` and
+  `priority` is `20`. Local backends in
+  [`secrets`](../secrets/SPEC.md) must out-prioritize this for `local` /
+  `dev` tiers, or local development will attempt to push to Cloudflare.
+- `getClientConfig` throws when `CLOUDFLARE_API_TOKEN` or
+  `CLOUDFLARE_ACCOUNT_ID` (or the descriptor-overridden env var names) are
+  unset. Bootstrapping a CF push without those env vars is a hard failure,
+  not a silent skip.
+- `JOB_RESULT_STORE_BINDING` / `JOB_RESULT_STORE_CLASS` /
+  `JOB_RESULT_STORE_INITIAL_MIGRATION_TAG` are the contract for cloud Flow
+  job-consumer workers. Consumers must use
+  `generateJobConsumerWorkerConfig` (or replicate the binding name and
+  initial-migration tag verbatim) — the [`workers`](../workers/SPEC.md)
+  cloud rendezvous protocol expects this exact shape.
+- New CF Durable Object classes must register via `newSqliteClasses` in
+  their initial migration. Plain `newClasses` is the legacy non-SQLite form
+  and is rejected by Cloudflare for accounts created after 2024-04-01.
+
+## Migration debt (completed)
+
+- [x] **Pages surface is missing.** 19 consumers (15
+  `apps/*/deployment.config.ts`, plus `infra/manifest.ts` and
+  `infra/generate.ts`) import `createCloudflarePagesDeployment` and
+  `renderWranglerJson` from `@vibesdotdev/infra-cloudflare/pages`. ~~The
+  `./pages` subpath is not declared in `package.json#exports`, no
+  `src/pages.ts` / `src/implementations/pages.impl.ts` files exist, and
+  there is no Pages-typed loader registered by the plugin. Restore the
+  Pages module (`pages` helpers, `implementations/pages.impl.ts`, plugin
+  registration for whichever kind it targets) and re-add the
+  `./pages` + `./implementations/pages` exports.~~
+  **Resolution:** Created `src/implementations/pages.impl.ts` with
+  `createCloudflarePagesDeployment`, `renderWranglerJson`, and
+  `generateCloudflarePagesDescriptor`. Created `src/pages.ts` as public
+  entrypoint. Added `./pages` and `./implementations/pages` to
+  `package.json#exports`. Registered `cloudflare-pages` loader for
+  `infra/web-app` kind in plugin.
+- [x] `src/secrets/cloudflare-api.impl.ts` uses
+  `require('@vibesdotdev/runtime')` inside `getCFProjectNames()` to dodge
+  a circular dependency. ~~Replace with a constructor-injected runtime
+  handle or a registered query callback so the file is ESM-clean.~~
+  **Resolution:** Replaced `require()` hack with a
+  `CFProjectNamesResolver` function type injected via constructor.
+  Plugin passes a resolver that queries `runtime.assets('infra/web-app')`
+  through the runtime handle. The implementation is now ESM-clean with
+  no dynamic requires.
+- [x] `getCFProjectNames()` derives Cloudflare project names from
+  `infra/web-app` descriptors using a hardcoded `vibes-{appId}` pattern.
+  ~~Move project-name resolution onto the descriptor (e.g. an explicit
+  `cfProjectName` field on `infra/web-app`) or codify the convention in
+  `infra-core`.~~ **Resolution:** Added optional `cfProjectName` field to
+  `WebAppDescriptorSchema` in `infra-core/src/kinds/web-app.kind.ts`.
+  The secrets backend now prefers `descriptor.cfProjectName` when
+  available, falling back to the `vibes-{appId}` convention for
+  backward compatibility.
+- [x] `cloudflareApiDescriptor` lives in `./src/secrets/` but is reachable
+  only via the package root. ~~Add a `./secrets` subpath in
+  `package.json#exports` so end users can import the descriptor + helper
+  client without pulling everything.~~ **Resolution:** Added
+  `"./secrets": "./src/secrets/index.ts"` to `package.json#exports`.
+
+## Public entrypoints
+
+`.`, `./pages`, `./implementations/workers`, `./implementations/queues`,
+`./implementations/r2`, `./implementations/kv`, `./implementations/pages`,
+`./plugin`, `./secrets`.
+
+The root export re-exports every `implementations/*` module plus
+`./secrets/index` and `cloudflarePlugin`.
+
+## Verification
+
+`bun test` from `packages/infra-cloudflare`. Covers descriptor parse +
+generated-config shape for workers, queues, r2, kv
+(`__tests__/{workers,queues,r2,kv}.test.ts`) plus plugin metadata and
+per-impl creation (`__tests__/plugin.test.ts`, 6 cases). Does not cover
+the `cloudflare-api` secrets backend — there is no
+`__tests__/secrets.test.ts`, and the v4 REST calls are not exercised in
+CI. `bun --bun tsc -p tsconfig.json --noEmit` is the type gate.
+
+## Links
+
+- [infra-core/SPEC.md](../infra-core/SPEC.md)
+- [infra-doks/SPEC.md](../infra-doks/SPEC.md)
+- [deploy/SPEC.md](../deploy/SPEC.md)
+- [secrets/SPEC.md](../secrets/SPEC.md)
+- [workers/SPEC.md](../workers/SPEC.md)

package/dist/cloudflare.plugin.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Cloudflare Infrastructure Plugin
+ *
+ * Registers Cloudflare provider implementations for each infra kind.
+ * When a descriptor's adapter/engine matches a Cloudflare provider,
+ * the corresponding config generator is loaded.
+ *
+ * Web apps deploy via @sveltejs/adapter-cloudflare Workers Static Assets,
+ * configured per-app in apps/{app}-web/wrangler.jsonc. The Pages module
+ * provides `createCloudflarePagesDeployment` and `renderWranglerJson`
+ * for consumers that need programmatic wrangler config generation.
+ */
+import { type CloudflareWorkerDescriptorInput, type WranglerWorkerConfig } from './implementations/workers.impl';
+import { type CloudflareQueueDescriptor } from './implementations/queues.impl';
+import { type CloudflareR2Descriptor } from './implementations/r2.impl';
+import { type CloudflareKVDescriptor } from './implementations/kv.impl';
+import { type CloudflarePagesDescriptor } from './implementations/pages.impl';
+import { type CloudflareWebAppDescriptorInput } from './implementations/web-app.impl';
+import { type CloudflareLogsDescriptorInput } from './implementations/logs.impl';
+import { type CloudflareAlertsDescriptorInput } from './implementations/alerts.impl';
+import { type CloudflareObservabilityDescriptorInput } from './implementations/observability.impl';
+import { type CloudflareRumDescriptorInput } from './implementations/rum.impl';
+declare function createWorkerImpl(input: CloudflareWorkerDescriptorInput): import("@vibesdotdev/runtime").RuntimeImplementationWrapper<{
+    generateConfig: () => WranglerWorkerConfig;
+}>;
+declare function createQueueImpl(input: CloudflareQueueDescriptor): import("@vibesdotdev/runtime").RuntimeImplementationWrapper<{
+    generateConfig: () => import("./index.ts").WranglerQueueProducerConfig;
+}>;
+declare function createR2Impl(input: CloudflareR2Descriptor): import("@vibesdotdev/runtime").RuntimeImplementationWrapper<{
+    generateConfig: () => import("./index.ts").WranglerR2Config;
+}>;
+declare function createKVImpl(input: CloudflareKVDescriptor): import("@vibesdotdev/runtime").RuntimeImplementationWrapper<{
+    generateConfig: () => import("./index.ts").WranglerKVConfig;
+}>;
+declare function createPagesImpl(input: CloudflarePagesDescriptor): import("@vibesdotdev/runtime").RuntimeImplementationWrapper<{
+    generateConfig: () => {
+        kind: "infra/web-app";
+        id: string;
+        name: string;
+        adapter: "cloudflare-workers" | "cloudflare-pages";
+        cfProjectName: string;
+        outputDir: string;
+        compatibilityFlags: string[];
+        env: Record<string, string>;
+        compatibilityDate?: string | undefined;
+        secretsStoreId?: string | undefined;
+    };
+    getProjectName: () => string;
+}>;
+declare function createWebAppImpl(input: CloudflareWebAppDescriptorInput): import("@vibesdotdev/runtime").RuntimeImplementationWrapper<{
+    generateConfig: () => {
+        kind: "infra/web-app";
+        id: string;
+        name: string;
+        adapter: "cloudflare-workers";
+        cfWorkerName: string;
+        outputDir: string;
+        workerEntry: string;
+        compatibilityFlags: string[];
+        env: Record<string, string>;
+        compatibilityDate?: string | undefined;
+        secretsStoreId?: string | undefined;
+    };
+    getWorkerName: () => string;
+}>;
+declare function createLogsImpl(input: CloudflareLogsDescriptorInput): import("@vibesdotdev/runtime").RuntimeImplementationWrapper<import("./index.ts").LogsImplementation>;
+declare function createAlertsImpl(input: CloudflareAlertsDescriptorInput): import("@vibesdotdev/runtime").RuntimeImplementationWrapper<import("@vibesdotdev/infra-core").AlertsImplementation>;
+declare function createObservabilityImpl(input: CloudflareObservabilityDescriptorInput): import("@vibesdotdev/runtime").RuntimeImplementationWrapper<import("@vibesdotdev/infra-core").ObservabilityImplementation>;
+declare function createRumImpl(input: CloudflareRumDescriptorInput): import("@vibesdotdev/runtime").RuntimeImplementationWrapper<import("@vibesdotdev/infra-core").RumImplementation>;
+export { createWorkerImpl, createQueueImpl, createR2Impl, createKVImpl, createPagesImpl, createWebAppImpl, createLogsImpl, createAlertsImpl, createObservabilityImpl, createRumImpl };
+declare const _default: import("@vibesdotdev/runtime").RuntimePlugin;
+export default _default;
+//# sourceMappingURL=cloudflare.plugin.d.ts.map

package/dist/cloudflare.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.plugin.d.ts","sourceRoot":"","sources":["../src/cloudflare.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAGN,KAAK,+BAA+B,EACpC,KAAK,oBAAoB,EACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAGN,KAAK,yBAAyB,EAC9B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAGN,KAAK,sBAAsB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGN,KAAK,sBAAsB,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGN,KAAK,yBAAyB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,KAAK,+BAA+B,EACpC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAGN,KAAK,6BAA6B,EAClC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGN,KAAK,+BAA+B,EACpC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAGN,KAAK,sCAAsC,EAC3C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAGN,KAAK,4BAA4B,EACjC,MAAM,4BAA4B,CAAC;AAQpC,iBAAS,gBAAgB,CAAC,KAAK,EAAE,+BAA+B;;GAU/D;AAED,iBAAS,eAAe,CAAC,KAAK,EAAE,yBAAyB;;GAUxD;AAED,iBAAS,YAAY,CAAC,KAAK,EAAE,sBAAsB;;GAUlD;AAED,iBAAS,YAAY,CAAC,KAAK,EAAE,sBAAsB;;GAUlD;AAED,iBAAS,eAAe,CAAC,KAAK,EAAE,yBAAyB;;;;;;;;;;;;;;GAWxD;AAED,iBAAS,gBAAgB,CAAC,KAAK,EAAE,+BAA+B;;;;;;;;;;;;;;;GAW/D;AAED,iBAAS,cAAc,CAAC,KAAK,EAAE,6BAA6B,wGAS3D;AAED,iBAAS,gBAAgB,CAAC,KAAK,EAAE,+BAA+B,uHAS/D;AAED,iBAAS,uBAAuB,CAAC,KAAK,EAAE,sCAAsC,8HAS7E;AAED,iBAAS,aAAa,CAAC,KAAK,EAAE,4BAA4B,oHASzD;AAED,OAAO,EACN,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,aAAa,EACb,CAAC;;AAEF,wBAkRG"}