@vibesdotdev/infra-core 0.0.1

package/src/kinds/object-storage.kind.ts

@@ -0,0 +1,101 @@
+/**
+ * Kind: infra/object-storage
+ *
+ * Describes object/blob storage.
+ *
+ * Schema shape: strict common base + `config` discriminated union.
+ *
+ * - The base defines fields universal across adapters: id/kind/name +
+ *   the storage shape (bucket, cors, lifecycle, publicAccess).
+ * - Adapter-specific fields (region, acl, …) live under `config`.
+ *   Each adapter package defines its own concrete schema.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
+import type { RuntimeKindDescriptorRecord } from '@vibesdotdev/runtime/schemas/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/runtime/schemas/descriptor';
+import type { RuntimeDescriptor } from '@vibesdotdev/runtime/schemas/descriptor';
+import { INFRA_DISCOVERY_PATTERN, extractStem } from './discovery.ts';
+
+export const CorsRuleSchema = z.object({
+	allowedOrigins: z.array(z.string()).default(['*']),
+	allowedMethods: z.array(z.string()).default(['GET']),
+	allowedHeaders: z.array(z.string()).optional(),
+	maxAgeSeconds: z.number().int().nonnegative().optional()
+});
+export type CorsRule = z.infer<typeof CorsRuleSchema>;
+
+export const LifecycleRuleSchema = z.object({
+	/** Prefix filter for matching objects */
+	prefix: z.string().optional(),
+	/** Days until expiration */
+	expiration: z.number().int().positive().optional(),
+	/** Storage class transition */
+	transition: z
+		.object({
+			days: z.number().int().positive(),
+			storageClass: z.string().min(1)
+		})
+		.optional()
+});
+export type LifecycleRule = z.infer<typeof LifecycleRuleSchema>;
+
+const ObjectStorageBaseSchema = RuntimeDescriptorSchema.extend({
+	kind: z.literal('infra/object-storage'),
+
+	/** Bucket name (defaults to descriptor id when omitted). */
+	bucket: z.string().min(1).optional(),
+
+	/** CORS rules. */
+	cors: z.array(CorsRuleSchema).optional(),
+
+	/** Lifecycle rules. */
+	lifecycle: z.array(LifecycleRuleSchema).optional(),
+
+	/** Whether the bucket is publicly readable. */
+	publicAccess: z.boolean().optional()
+});
+
+export const DOSpacesConfigSchema = z.object({
+	/** DO region (default: nyc3). */
+	region: z.string().min(1).default('nyc3')
+});
+
+export const CloudflareR2ConfigSchema = z.object({});
+
+export const ObjectStorageConfigSchema = z.union([
+	DOSpacesConfigSchema.extend({ adapter: z.literal('do-spaces') }),
+	CloudflareR2ConfigSchema.extend({ adapter: z.literal('cloudflare-r2') })
+]);
+
+export const ObjectStorageDescriptorSchema = ObjectStorageBaseSchema.extend({
+	/**
+	 * Adapter-specific configuration. Discriminated union — each adapter
+	 * package defines its own config schema under its discriminator key.
+	 */
+	config: ObjectStorageConfigSchema.optional()
+});
+
+export type ObjectStorageDescriptor = z.infer<typeof ObjectStorageDescriptorSchema>;
+
+class DefaultObjectStorageImplementation {
+	constructor(
+		public readonly descriptor: RuntimeDescriptor,
+		public readonly context: unknown
+	) {}
+
+	get config(): ObjectStorageDescriptor {
+		return this.descriptor as ObjectStorageDescriptor;
+	}
+}
+
+export const objectStorageKind = createRuntimeKind<
+	ObjectStorageDescriptor,
+	DefaultObjectStorageImplementation
+>({
+	id: 'infra/object-storage',
+	descriptorSchema: ObjectStorageDescriptorSchema,
+	defaultImplementation: DefaultObjectStorageImplementation,
+	discoveryPattern: INFRA_DISCOVERY_PATTERN,
+	extractStem
+});

package/src/kinds/observability.kind.ts

@@ -0,0 +1,178 @@
+/**
+ * Infra Observability Kind
+ *
+ * Provider-agnostic per-Worker (or fleet-wide) observability config —
+ * sampling rate, log/trace toggles, export destinations. Decouples
+ * observability concerns from the `infra/web-app` descriptor so:
+ *
+ *   1. The CLI can introspect + write settings across the entire fleet
+ *      without going through deploy.
+ *   2. Cross-cutting policies (e.g. "10% sampling on every customer-facing
+ *      Worker") have a single declarative shape.
+ *   3. Provider impls map onto the native control plane (CF Workers
+ *      Observability, DO Monitoring, Datadog, etc.).
+ *
+ * CLI surface (`vibes infra observability …`):
+ *   status [--worker]                      read current settings
+ *   set    [--worker] --sampling 0.1       write new settings
+ *   exports list|add|remove                (Phase 2.5; not yet wired)
+ *
+ * Production Workers consume settings via their wrangler.jsonc; the CLI
+ * writes directly to the provider API for immediate effect. To avoid
+ * drift, `vibes infra deploy regenerate` is the canonical declarative
+ * path — the CLI here is for ops-time tuning between deploys.
+ */
+
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/runtime/schemas/descriptor';
+import { INFRA_DISCOVERY_PATTERN, extractStem } from './discovery.ts';
+
+const ObservabilityScopeSchema = z.discriminatedUnion('kind', [
+	z.object({
+		kind: z.literal('worker'),
+		workerName: z.string().min(1)
+	}),
+	z.object({
+		kind: z.literal('account-wide'),
+		/** When set, restrict the fleet sweep to workers matching the glob. */
+		filter: z.string().optional()
+	})
+]);
+
+export type ObservabilityScope = z.infer<typeof ObservabilityScopeSchema>;
+
+/**
+ * Standard observability settings shape. Provider impls translate
+ * these onto native fields (CF: `observability.head_sampling_rate`,
+ * Datadog: `apm_sampling_rate`, etc.).
+ */
+const ObservabilitySettingsSchema = z.object({
+	logs: z
+		.object({
+			enabled: z.boolean(),
+			/**
+			 * Head sampling rate, 0..1. Providers without head-sampling
+			 * (e.g. Logpush-only setups) treat this as a hint and may
+			 * implement tail-sampling at the destination instead.
+			 */
+			headSamplingRate: z.number().min(0).max(1).optional(),
+			structured: z.boolean().optional(),
+			/** Persist logs for dashboard view (CF: observability.logs.persist). */
+			persist: z.boolean().optional(),
+			/** Capture per-request invocation envelopes (CF only). */
+			invocationLogs: z.boolean().optional()
+		})
+		.optional(),
+	traces: z
+		.object({
+			enabled: z.boolean(),
+			headSamplingRate: z.number().min(0).max(1).optional(),
+			persist: z.boolean().optional(),
+			exporter: z
+				.object({
+					kind: z.enum(['otlp', 'datadog', 'jaeger']),
+					endpoint: z.string().url(),
+					tokenSecretKey: z.string().optional()
+				})
+				.optional()
+		})
+		.optional(),
+	exports: z
+		.array(
+			z.discriminatedUnion('kind', [
+				z.object({
+					kind: z.literal('logflare'),
+					tokenSecretKey: z.string()
+				}),
+				z.object({
+					kind: z.literal('datadog'),
+					apiKeySecretKey: z.string(),
+					site: z.string()
+				}),
+				z.object({
+					kind: z.literal('logpush'),
+					destination: z.string(),
+					dataset: z.string()
+				})
+			])
+		)
+		.optional()
+});
+
+export type ObservabilitySettings = z.infer<typeof ObservabilitySettingsSchema>;
+
+const ObservabilityBaseSchema = RuntimeDescriptorSchema.extend({
+	kind: z.literal('infra/observability'),
+	adapter: z.string().min(1),
+	adapterConfig: z.record(z.string(), z.unknown()).optional(),
+	environment: z.string().default('local'),
+	/**
+	 * Default scope when the descriptor is used standalone (e.g.
+	 * `vibes infra observability status` with no --worker flag). When
+	 * the CLI passes an explicit scope, this is ignored.
+	 */
+	defaultScope: ObservabilityScopeSchema.default({ kind: 'account-wide' }),
+	/**
+	 * Optional declared settings — used by `vibes infra observability
+	 * sync` (future) to drive a desired-state reconciliation. Today the
+	 * CLI imperatively sets values per call.
+	 */
+	settings: ObservabilitySettingsSchema.optional()
+});
+
+export type InfraObservabilityDescriptor = z.infer<typeof ObservabilityBaseSchema>;
+export type InfraObservabilityDescriptorInput = z.input<typeof ObservabilityBaseSchema>;
+
+/**
+ * Snapshot of the live settings for a single Worker (or other scope).
+ * Returned by `getStatus`; consumed by the CLI for table-rendering.
+ */
+export interface ObservabilitySnapshot {
+	workerName: string;
+	settings: ObservabilitySettings;
+	/** Last-modified timestamp from the provider, when available. */
+	modifiedAt?: string;
+}
+
+export interface SetObservabilityInput {
+	scope: ObservabilityScope;
+	settings: ObservabilitySettings;
+	/** Skip Workers that already match desired state. Defaults to true. */
+	skipUnchanged?: boolean;
+}
+
+export interface SetObservabilityResult {
+	changed: Array<{ workerName: string; before: ObservabilitySettings; after: ObservabilitySettings }>;
+	unchanged: string[];
+	failed: Array<{ workerName: string; error: string }>;
+}
+
+/**
+ * Implementation contract every provider implements.
+ */
+export interface ObservabilityImplementation {
+	/** Read current settings for a scope. account-wide → one snapshot per Worker. */
+	getStatus(scope: ObservabilityScope): Promise<ObservabilitySnapshot[]>;
+	/** Apply settings to a scope. Returns per-Worker outcome. */
+	set(input: SetObservabilityInput): Promise<SetObservabilityResult>;
+}
+
+export const observabilityKind = createRuntimeKind<
+	InfraObservabilityDescriptor,
+	ObservabilityImplementation
+>({
+	id: 'infra/observability',
+	descriptorSchema: ObservabilityBaseSchema,
+	discoveryPattern: INFRA_DISCOVERY_PATTERN,
+	extractStem
+});
+
+export type InfraObservabilityKind = InfraObservabilityDescriptor;
+export type InfraObservabilityKindInput = InfraObservabilityDescriptorInput;
+
+export {
+	ObservabilityBaseSchema as InfraObservabilityDescriptorSchema,
+	ObservabilityScopeSchema,
+	ObservabilitySettingsSchema
+};

package/src/kinds/package-registry.kind.ts

@@ -0,0 +1,95 @@
+/**
+ * Kind: infra/package-registry
+ *
+ * Describes a package registry instance (npm, Docker, Maven, Helm, etc.).
+ *
+ * Schema shape: strict common base + `config` discriminated union.
+ *
+ * - The base (this file) defines fields that are universal across every
+ *   adapter: id/kind/name + the registry shape every package host declares
+ *   (url, registryType, scope, upstreamUrl, authRequired, ssl, env).
+ * - Adapter-specific fields (dockerImage, storageSize, domain, …)
+ *   live exclusively under `config`. Each adapter package defines its own
+ *   concrete schema under its discriminator key.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
+import type { RuntimeKindDescriptorRecord } from '@vibesdotdev/runtime/schemas/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/runtime/schemas/descriptor';
+import type { RuntimeDescriptor } from '@vibesdotdev/runtime/schemas/descriptor';
+import { INFRA_DISCOVERY_PATTERN, extractStem } from './discovery.ts';
+import { deploymentEnvRequirementSchema } from '../schemas.ts';
+
+export const PackageRegistryTypeSchema = z.enum(['npm', 'docker', 'maven', 'helm']);
+export type PackageRegistryType = z.infer<typeof PackageRegistryTypeSchema>;
+
+const PackageRegistryBaseSchema = RuntimeDescriptorSchema.extend({
+	kind: z.literal('infra/package-registry'),
+
+	/** Primary access URL (e.g. 'https://packages.vibes.dev'). */
+	url: z.string().url(),
+
+	/** Package type this registry serves. */
+	registryType: PackageRegistryTypeSchema.default('npm'),
+
+	/** Npm scope this registry owns (e.g. '@vibesdotdev'). */
+	scope: z.string().optional(),
+
+	/** Upstream registry URL this registry proxies (optional). */
+	upstreamUrl: z.string().url().optional(),
+
+	/** Whether authentication is required to pull from this registry. */
+	authRequired: z.boolean().default(true),
+
+	/** Whether TLS is enabled. */
+	ssl: z.boolean().default(true),
+
+	/** Environment variable requirements. */
+	env: z.array(deploymentEnvRequirementSchema).optional()
+});
+
+export const VerdaccioDoksPackageRegistryConfigSchema = z.object({
+	/** Docker image for the Verdaccio container. */
+	dockerImage: z.string().default('verdaccio/verdaccio:5'),
+	/** Persistent storage size (e.g. '10Gi'). */
+	storageSize: z.string().default('10Gi'),
+	/** Primary domain for the registry. */
+	domain: z.string().min(1),
+	/** Upstream npm registry URL to proxy. */
+	upstreamNpmUrl: z.string().url().default('https://registry.npmjs.org'),
+	/** Whether built-in authentication is enabled. */
+	authEnabled: z.boolean().default(true)
+});
+
+export const PackageRegistryConfigSchema = z.union([
+	VerdaccioDoksPackageRegistryConfigSchema.extend({ adapter: z.literal('verdaccio-doks') })
+]);
+
+export const PackageRegistryDescriptorSchema = PackageRegistryBaseSchema.extend({
+	/**
+	 * Adapter-specific configuration. Discriminated union — each adapter
+	 * package defines its own config schema under its discriminator key.
+	 */
+	config: PackageRegistryConfigSchema.optional()
+});
+
+export type PackageRegistryDescriptor = z.infer<typeof PackageRegistryDescriptorSchema>;
+
+class DefaultPackageRegistryImplementation {
+	constructor(
+		public readonly descriptor: RuntimeDescriptor,
+		public readonly context: unknown
+	) {}
+
+	get config(): PackageRegistryDescriptor {
+		return this.descriptor as PackageRegistryDescriptor;
+	}
+}
+
+export const packageRegistryKind = createRuntimeKind<PackageRegistryDescriptor, DefaultPackageRegistryImplementation>({
+	id: 'infra/package-registry',
+	descriptorSchema: PackageRegistryDescriptorSchema,
+	defaultImplementation: DefaultPackageRegistryImplementation,
+	discoveryPattern: INFRA_DISCOVERY_PATTERN,
+	extractStem
+});

package/src/kinds/queue.kind.ts

@@ -0,0 +1,102 @@
+/**
+ * Kind: infra/queue
+ *
+ * Describes a message queue system.
+ *
+ * Schema shape: strict common base + `config` discriminated union.
+ *
+ * - The base defines fields universal across adapters: id/kind/name +
+ *   the queue shape (engine, topics, maxBatchSize, maxRetries, deadLetterQueue).
+ * - Adapter-specific fields (namespace, storageSize, resources, …) live under
+ *   `config`. Each adapter package defines its own concrete schema.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
+import type { RuntimeKindDescriptorRecord } from '@vibesdotdev/runtime/schemas/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/runtime/schemas/descriptor';
+import type { RuntimeDescriptor } from '@vibesdotdev/runtime/schemas/descriptor';
+import { INFRA_DISCOVERY_PATTERN, extractStem } from './discovery.ts';
+
+export const QueueTopicSchema = z.object({
+	name: z.string().min(1),
+	partitions: z.number().int().positive().optional(),
+	retention: z.string().optional(),
+	replication: z.number().int().positive().optional()
+});
+export type QueueTopic = z.infer<typeof QueueTopicSchema>;
+
+const QueueBaseSchema = RuntimeDescriptorSchema.extend({
+	kind: z.literal('infra/queue'),
+
+	/** Queue engine (e.g., 'cloudflare-queues', 'redpanda'). */
+	engine: z.string().min(1).optional(),
+
+	/** Topic / queue declarations. */
+	topics: z.array(QueueTopicSchema).optional(),
+
+	/** Maximum batch size. */
+	maxBatchSize: z.number().int().positive().optional(),
+
+	/** Maximum retry count. */
+	maxRetries: z.number().int().nonnegative().optional(),
+
+	/** Dead-letter queue id. */
+	deadLetterQueue: z.string().optional()
+});
+
+export const DoksQueueConfigSchema = z.object({
+	/** Kubernetes namespace (default: vibes). */
+	namespace: z.string().min(1).default('vibes'),
+	/** Storage size for data volume (default: 10Gi). */
+	storageSize: z.string().min(1).default('10Gi'),
+	/** Container resources. */
+	resources: z
+		.object({
+			requests: z.object({ cpu: z.string().min(1), memory: z.string().min(1) }).optional(),
+			limits: z.object({ cpu: z.string().min(1), memory: z.string().min(1) }).optional()
+		})
+		.optional()
+});
+
+export const CloudflareQueuesConfigSchema = z.object({
+	/** Maximum batch size per message. */
+	maxBatchSize: z.number().int().positive().default(10),
+	/** Maximum retry count. */
+	maxRetries: z.number().int().nonnegative().default(3),
+	/** Dead-letter queue id. */
+	deadLetterQueue: z.string().min(1).optional()
+});
+
+export const QueueConfigSchema = z.union([
+	DoksQueueConfigSchema.extend({ adapter: z.literal('doks-statefulset') }),
+	CloudflareQueuesConfigSchema.extend({ adapter: z.literal('cloudflare-queues') })
+]);
+
+export const QueueDescriptorSchema = QueueBaseSchema.extend({
+	/**
+	 * Adapter-specific configuration. Discriminated union — each adapter
+	 * package defines its own config schema under its discriminator key.
+	 */
+	config: QueueConfigSchema.optional()
+});
+
+export type QueueDescriptor = z.infer<typeof QueueDescriptorSchema>;
+
+class DefaultQueueImplementation {
+	constructor(
+		public readonly descriptor: RuntimeDescriptor,
+		public readonly context: unknown
+	) {}
+
+	get config(): QueueDescriptor {
+		return this.descriptor as QueueDescriptor;
+	}
+}
+
+export const queueKind = createRuntimeKind<QueueDescriptor, DefaultQueueImplementation>({
+	id: 'infra/queue',
+	descriptorSchema: QueueDescriptorSchema,
+	defaultImplementation: DefaultQueueImplementation,
+	discoveryPattern: INFRA_DISCOVERY_PATTERN,
+	extractStem
+});

package/src/kinds/rum.kind.ts

@@ -0,0 +1,135 @@
+/**
+ * Infra RUM (Real User Monitoring) Kind
+ *
+ * Provider-agnostic schema for beacon-based front-end telemetry —
+ * page-load timing, Core Web Vitals, navigation timing. Provider impls
+ * map this shape onto native services:
+ *
+ *   cloudflare-web-analytics → CF Web Analytics (sites + auto-injection rules)
+ *   sentry-replay            → Sentry Performance + Session Replay
+ *   plausible                → Plausible Analytics
+ *
+ * The kind decouples *configuration* (which hostnames, which token,
+ * which privacy mode) from *delivery* (how the beacon `<script>` tag
+ * lands in the HTML). For SvelteKit apps, the
+ * `@vibesdotdev/cloudflare-web-analytics` package provides a `handle`
+ * hook that injects the beacon via `transformPageChunk` — no
+ * per-app `app.html` edits required once the kind is wired in.
+ */
+
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/runtime/schemas/descriptor';
+import { INFRA_DISCOVERY_PATTERN, extractStem } from './discovery.ts';
+
+const RumPrivacySchema = z.object({
+	/** Drop EU visitor data at the beacon level (GDPR fast path). */
+	excludeEU: z.boolean().default(false),
+	/** Honor Do-Not-Track / Global Privacy Control headers. */
+	respectDoNotTrack: z.boolean().default(true),
+	/** Strip PII (query params, fragments) from reported URLs. */
+	stripQueryParams: z.boolean().default(false)
+});
+
+export type RumPrivacy = z.infer<typeof RumPrivacySchema>;
+
+/**
+ * Where + how the beacon `<script>` lands in the served HTML.
+ *
+ *   app-html               → bake the snippet into app.html (manual; pre-Phase 3)
+ *   sveltekit-hook         → injected via `transformPageChunk` in handle hook (preferred)
+ *   provider-auto          → provider auto-injection (CF: only works on non-Worker traffic)
+ *   custom                 → caller injects however they want; we just track config
+ */
+const RumInjectionSchema = z.enum([
+	'app-html',
+	'sveltekit-hook',
+	'provider-auto',
+	'custom'
+]);
+
+export type RumInjection = z.infer<typeof RumInjectionSchema>;
+
+const RumBaseSchema = RuntimeDescriptorSchema.extend({
+	kind: z.literal('infra/rum'),
+	adapter: z.string().min(1),
+	adapterConfig: z.record(z.string(), z.unknown()).optional(),
+	environment: z.string().default('local'),
+	/**
+	 * Public site token (a.k.a. site_tag / beacon token / measurement
+	 * id). Provider-specific format; safe to commit because it's
+	 * embedded in client-side HTML for every visitor to see.
+	 *
+	 * Pass `{ source: 'secret', key: 'NAME' }` only when the provider
+	 * explicitly wants a private token — most don't.
+	 */
+	siteToken: z.union([
+		z.string().min(1),
+		z.object({ source: z.literal('secret'), key: z.string().min(1) })
+	]),
+	/** Hostnames the beacon should report from. `*` matches all subdomains. */
+	hostnames: z.array(z.string().min(1)).default(['*']),
+	injection: RumInjectionSchema.default('sveltekit-hook'),
+	privacy: RumPrivacySchema.default(() => ({
+		excludeEU: false,
+		respectDoNotTrack: true,
+		stripQueryParams: false
+	})),
+	/** Whether the site is currently enabled. Provider impls read+write this. */
+	enabled: z.boolean().default(true)
+});
+
+export type InfraRumDescriptor = z.infer<typeof RumBaseSchema>;
+export type InfraRumDescriptorInput = z.input<typeof RumBaseSchema>;
+
+/**
+ * Snapshot of a single configured RUM site on the provider. Returned
+ * by `listSites`; consumed by the CLI for table rendering and drift
+ * detection.
+ */
+export interface RumSiteSnapshot {
+	/** Provider-assigned site id (CF: site_tag). */
+	siteTag: string;
+	/** Friendly name (often the apex hostname). */
+	name?: string;
+	hostnames: string[];
+	enabled: boolean;
+	injection?: RumInjection;
+	/** Page-views captured in the last 24h (when available). */
+	pageViews24h?: number;
+	createdAt?: string;
+}
+
+export interface RumImplementation {
+	/** Enumerate the configured RUM sites on the provider. */
+	listSites(): Promise<RumSiteSnapshot[]>;
+	/** Look up a single site by siteTag. */
+	getSite(siteTag: string): Promise<RumSiteSnapshot | null>;
+	/**
+	 * Ensure a site exists matching the descriptor; returns the
+	 * siteTag (provider-assigned id) and whether it was created or
+	 * already existed.
+	 */
+	ensureSite(descriptor: InfraRumDescriptor): Promise<{
+		siteTag: string;
+		created: boolean;
+	}>;
+	/** Toggle enabled state. */
+	setEnabled(siteTag: string, enabled: boolean): Promise<void>;
+}
+
+export const rumKind = createRuntimeKind<InfraRumDescriptor, RumImplementation>({
+	id: 'infra/rum',
+	descriptorSchema: RumBaseSchema,
+	discoveryPattern: INFRA_DISCOVERY_PATTERN,
+	extractStem
+});
+
+export type InfraRumKind = InfraRumDescriptor;
+export type InfraRumKindInput = InfraRumDescriptorInput;
+
+export {
+	RumBaseSchema as InfraRumDescriptorSchema,
+	RumPrivacySchema,
+	RumInjectionSchema
+};