@vibesdotdev/infra-deploy 0.0.1

package/src/cli/logs/infra-logs.cli-command.impl.ts

@@ -0,0 +1,354 @@
+import { getVibesRuntime } from '@vibesdotdev/runtime';
+import { requestCLIExit, type UIContext } from '@vibesdotdev/cli/providers';
+import type { LogsImplementation, InfraLogsDescriptor } from '@vibesdotdev/infra-core';
+import { discoverDeployments, type DiscoveredDeployment } from '../shared/discover-deployments.ts';
+import { streamWorkerTail, type TailRecord } from './stream-worker-tail.ts';
+
+/** Parse a duration suffix like "30s", "2m", "1h" → milliseconds. Falls back to 30s. */
+function parseDurationMs(input: string | undefined): number {
+	if (!input) return 30_000;
+	const m = /^(\d+)\s*(ms|s|m|h)?$/i.exec(input.trim());
+	if (!m) return 30_000;
+	const n = Number.parseInt(m[1]!, 10);
+	const unit = (m[2] ?? 's').toLowerCase();
+	if (unit === 'ms') return n;
+	if (unit === 's') return n * 1000;
+	if (unit === 'm') return n * 60_000;
+	if (unit === 'h') return n * 3_600_000;
+	return 30_000;
+}
+
+function readString(v: unknown): string | undefined {
+	if (typeof v === 'string') return v.length > 0 ? v : undefined;
+	if (typeof v === 'number' && Number.isFinite(v)) return String(v);
+	return undefined;
+}
+
+function readBoolean(v: unknown): boolean {
+	return v === true || v === 'true';
+}
+
+function descriptorHasWorkerSource(descriptor: InfraLogsDescriptor, workerName: string): boolean {
+	return descriptor.sources?.some(
+		(s) => s.type === 'worker' && (s.name === workerName || descriptor.id === workerName)
+	) ?? false;
+}
+
+/**
+ * Map an `infra/logs` descriptor adapter name to the deployment provider that
+ * emits workers for it. Extend as new providers register infra/logs adapters.
+ */
+function adapterToProvider(adapter: string): string | undefined {
+	if (adapter === 'cloudflare-logs') return 'cloudflare-workers';
+	return undefined;
+}
+
+/**
+ * Build the `sources` list a logs descriptor should expose at display time
+ * by merging anything declared in the descriptor with workers discovered
+ * from the workspace's `deployment.config.ts` files. Sources are always
+ * de-duped by name.
+ */
+function mergeDescriptorSources(
+	descriptor: InfraLogsDescriptor,
+	discovered: DiscoveredDeployment[]
+): InfraLogsDescriptor['sources'] {
+	const provider = adapterToProvider(descriptor.adapter);
+	const fromWorkspace = discovered
+		.filter((d) => !provider || d.provider === provider)
+		.filter((d) => Boolean(d.workerName))
+		.map((d) => ({ type: 'worker' as const, name: d.workerName! }));
+
+	const seen = new Set<string>();
+	const merged: NonNullable<InfraLogsDescriptor['sources']> = [];
+	for (const src of [...(descriptor.sources ?? []), ...fromWorkspace]) {
+		const key = `${src.type}:${src.name}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		merged.push(src);
+	}
+	return merged;
+}
+
+export default {
+	async execute(args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
+		const runtime = await getVibesRuntime();
+		const ui = (await runtime.context('cli/ui')) as UIContext;
+
+		const sourceName = readString(args.source);
+		const workerName = readString(args.worker);
+		const output = readString(opts.output) ?? 'table';
+		const showAnalytics = readBoolean(opts.analytics);
+		const timeStart = readString(opts.timeStart) ?? '24h';
+		const doTail = readBoolean(opts.tail);
+		const status = readString(opts.status) as 'ok' | 'error' | 'canceled' | undefined;
+		const limitRaw = readString(opts.limit) ?? '100';
+		const limit = Number.parseInt(limitRaw, 10);
+		const windowRaw = readString(opts.window);
+		const windowMs = parseDurationMs(windowRaw);
+
+		// Get all infra/logs descriptors
+		const logsAssets = runtime.assets('infra/logs');
+		const rawDescriptors = logsAssets.descriptors() as InfraLogsDescriptor[];
+
+		if (rawDescriptors.length === 0) {
+			if (output === 'json') ui.json([]);
+			else ui.info('No log sources configured. Add an infra/logs descriptor to enable log querying.');
+			return;
+		}
+
+		// Augment each descriptor's sources by discovering workers from the
+		// workspace's deployment.config.ts files. Framework-registered
+		// descriptors carry no app-name list — that inventory lives in
+		// per-app deployment configs and is resolved here at call time.
+		const discovered = await discoverDeployments();
+		const descriptors: InfraLogsDescriptor[] = rawDescriptors.map((d) => ({
+			...d,
+			sources: mergeDescriptorSources(d, discovered)
+		}));
+
+		// Resolve implementations for each descriptor
+		const implementations: Array<{
+			id: string;
+			descriptor: InfraLogsDescriptor;
+			implementation: LogsImplementation | null;
+			error?: string;
+		}> = [];
+
+		for (const descriptor of descriptors) {
+			try {
+				const resolved = await runtime.query('infra/logs').withId(descriptor.id).resolve();
+				const resolvedObj = resolved as unknown as { 
+					id: string; 
+					descriptor: InfraLogsDescriptor; 
+					connector: unknown;
+					implementation?: LogsImplementation;
+				};
+				
+				// The resolved object may have implementation directly or nested
+				const impl = resolvedObj.implementation ?? 
+				           (resolvedObj as unknown as LogsImplementation);
+				
+				implementations.push({
+					id: descriptor.id,
+					descriptor,
+					implementation: impl && typeof impl === 'object' && 'getAnalytics' in impl ? impl : null,
+					error: impl && typeof impl === 'object' && 'getAnalytics' in impl ? undefined : 'Implementation not available'
+				});
+			} catch (err) {
+				implementations.push({
+					id: descriptor.id,
+					descriptor,
+					implementation: null,
+					error: (err as Error).message
+				});
+			}
+		}
+
+		// If a specific source is requested, find it
+		if (sourceName) {
+			const implEntry = implementations.find((impl) =>
+				impl.id === sourceName ||
+				descriptorHasWorkerSource(impl.descriptor, sourceName)
+			);
+			if (!implEntry) {
+				ui.error(`Log source '${sourceName}' not found. Available sources: ${implementations.map((impl) => impl.id).join(', ')}`);
+				requestCLIExit(1);
+			}
+
+			const { implementation: logsImpl, descriptor, error } = implEntry;
+
+			if (!logsImpl) {
+				ui.error(`Cannot access log source '${sourceName}': ${error ?? 'Implementation not available'}`);
+				ui.info('Make sure credentials are configured in your secrets store or environment.');
+				return;
+			}
+
+			let targetWorker: string;
+			if (workerName) {
+				const specific = descriptor.sources?.find(s => s.type === 'worker' && s.name === workerName);
+				if (!specific) {
+					// Worker not in the discovered inventory — pass it through to
+					// the provider anyway so the user can target ad-hoc names
+					// (workers deployed outside this workspace, sandbox names,
+					// preview environments, etc.). The provider will return a
+					// clean error if the worker truly doesn't exist.
+					const known = descriptor.sources?.map((s) => s.name).join(', ') || '(none discovered)';
+					ui.info(`Worker '${workerName}' is not in the discovered inventory (known: ${known}). Passing through to the provider.`);
+				}
+				targetWorker = workerName;
+			} else {
+				const workerSource = descriptor.sources?.find(s => s.type === 'worker');
+				targetWorker = workerSource?.name ?? sourceName;
+			}
+
+			if (doTail) {
+				// Real-time log streaming
+				const tailResult = await logsImpl.tailLogs(targetWorker, { status, limit });
+				ui.info(`Log tail started: ${tailResult.tailId} (worker=${targetWorker})`);
+				await streamWorkerTail({
+					url: tailResult.websocketUrl,
+					ui,
+					filterStatus: status,
+					limit
+				});
+				try {
+					await logsImpl.stopTail(targetWorker, tailResult.tailId);
+				} catch {
+					// best-effort cleanup
+				}
+			} else if (showAnalytics) {
+				// Analytics summary
+				const analytics = await logsImpl.getAnalytics(targetWorker, { timeStart });
+				if (output === 'json') {
+					ui.json(analytics);
+				} else {
+					ui.info(`Analytics for ${targetWorker} (${timeStart}):`);
+					ui.table([
+						{ metric: 'Total Invocations', value: analytics.totalInvocations.toString() },
+						{ metric: 'Error Count', value: analytics.errorCount.toString() },
+						{ metric: 'Error Rate', value: `${(analytics.errorRate * 100).toFixed(2)}%` },
+						{ metric: 'Avg Duration', value: `${analytics.avgDurationMs.toFixed(2)}ms` },
+						{ metric: 'P99 Duration', value: `${analytics.p99DurationMs.toFixed(2)}ms` },
+						{ metric: 'Total CPU Time', value: `${analytics.totalCpuTimeMs}ms` }
+					], { columns: ['metric', 'value'] });
+				}
+			} else if (workerName) {
+				// Windowed query: a worker was named without --tail/--analytics.
+				// Cloudflare exposes only live Tail for per-event data, so we
+				// open a tail session, capture for `--window` (default 30s),
+				// then close. This is the closest thing to a batch query.
+				const tailResult = await logsImpl.tailLogs(targetWorker, { status, limit });
+				if (output !== 'json') {
+					ui.info(
+						`Log query: ${targetWorker} (window=${windowRaw ?? '30s'}, status=${status ?? 'any'}, limit=${limit}). ` +
+						`Note: Cloudflare exposes only live Tail for per-event data — this captures errors during the window, not historical lookback.`
+					);
+				}
+				const records = await streamWorkerTail({
+					url: tailResult.websocketUrl,
+					ui,
+					filterStatus: status,
+					limit,
+					windowMs,
+					collect: true
+				});
+				try {
+					await logsImpl.stopTail(targetWorker, tailResult.tailId);
+				} catch {
+					// best-effort cleanup
+				}
+
+				const entries = records.map((rec: TailRecord) => ({
+					timestamp: rec.eventTimestamp ? new Date(rec.eventTimestamp).toISOString() : null,
+					outcome: rec.outcome ?? null,
+					scriptName: rec.scriptName ?? targetWorker,
+					method: rec.event?.request?.method ?? null,
+					url: rec.event?.request?.url ?? null,
+					responseStatus: rec.event?.response?.status ?? null,
+					trigger:
+						rec.event?.cron ? `cron ${rec.event.cron}` :
+						rec.event?.rpcMethod ? `rpc ${rec.event.rpcMethod}` :
+						rec.event?.request ? 'request' : 'event',
+					logs: (rec.logs ?? []).map((l) => ({
+						level: l.level ?? 'log',
+						message: (l.message ?? []).map((m) =>
+							typeof m === 'string' ? m : (() => { try { return JSON.stringify(m); } catch { return String(m); } })()
+						).join(' '),
+						timestamp: l.timestamp ? new Date(l.timestamp).toISOString() : null
+					})),
+					exceptions: (rec.exceptions ?? []).map((e) => ({
+						name: e.name ?? 'Error',
+						message: e.message ?? '',
+						timestamp: e.timestamp ? new Date(e.timestamp).toISOString() : null
+					}))
+				}));
+
+				if (output === 'json') {
+					ui.json({
+						source: descriptor.id,
+						worker: targetWorker,
+						window: windowRaw ?? '30s',
+						status: status ?? null,
+						limit,
+						capturedAt: new Date().toISOString(),
+						count: entries.length,
+						entries
+					});
+				} else {
+					if (entries.length === 0) {
+						ui.info(`No log entries captured in the ${windowRaw ?? '30s'} window.`);
+					} else {
+						ui.info(`Captured ${entries.length} entries.`);
+					}
+				}
+			} else {
+				// No worker specified — show descriptor info.
+				if (output === 'json') {
+					ui.json({ descriptor });
+				} else {
+					ui.info(`Log source: ${descriptor.name ?? descriptor.id}`);
+					ui.info(`Adapter: ${descriptor.adapter}`);
+					ui.info(`Sources: ${descriptor.sources.length}`);
+					if (descriptor.sources.length > 0) {
+						ui.table(descriptor.sources, { columns: ['type', 'name', 'environment'] });
+					}
+					ui.info('');
+					ui.info(`To query a specific worker:`);
+					ui.info(`  vibes infra logs ${descriptor.id} <worker> --status=error --window=30s --output=json`);
+				}
+			}
+			return;
+		}
+
+		// List all log sources
+		const rows: Array<{
+			id: string;
+			name: string;
+			adapter: string;
+			sources: string;
+			status: string;
+		}> = [];
+
+		for (const impl of implementations) {
+			const descriptor = impl.descriptor;
+			const sourceCount = descriptor.sources?.length ?? 0;
+			
+			rows.push({
+				id: impl.id,
+				name: descriptor.name ?? impl.id,
+				adapter: descriptor.adapter,
+				sources: sourceCount.toString(),
+				status: impl.error ? 'error' : 'active'
+			});
+		}
+
+		if (output === 'json') {
+			ui.json(rows);
+		} else {
+			ui.info('Available log sources:');
+			ui.table(rows, { columns: ['id', 'name', 'adapter', 'sources', 'status'] });
+			ui.info('');
+			ui.info('Usage:');
+			ui.info('  vibes infra logs <source>                       # Show source details');
+			ui.info('  vibes infra logs <source> <worker>              # Windowed query (30s capture)');
+			ui.info('  vibes infra logs <source> <worker> --analytics  # Aggregate analytics');
+			ui.info('  vibes infra logs <source> <worker> --tail       # Stream logs in real-time');
+			ui.info('');
+			ui.info('Examples:');
+			ui.info('  vibes infra logs cloudflare-logs vibes-auth --status=error --window=60s --output=json');
+			ui.info('  vibes infra logs cloudflare-logs vibes-auth --analytics --timeStart=2h');
+			ui.info('  vibes infra logs cloudflare-logs vibes-auth --tail --status=error');
+			
+			// Show errors if any
+			const errors = implementations.filter(i => i.error);
+			if (errors.length > 0) {
+				ui.info('');
+				ui.info('Errors:');
+				for (const err of errors) {
+					ui.error(`  ${err.id}: ${err.error}`);
+				}
+			}
+		}
+	}
+};

package/src/cli/logs/stream-worker-tail.ts

@@ -0,0 +1,202 @@
+/**
+ * Minimal Cloudflare Worker tail WebSocket consumer.
+ *
+ * Connects to the WS URL returned by `POST /accounts/.../workers/scripts/.../tails`,
+ * sends the trace-v1 handshake, and prints each incoming log record as a
+ * formatted line to stdout. Exits cleanly on SIGINT.
+ *
+ * The server applies the filters supplied at tail-creation time, so we only
+ * format here — no client-side filtering beyond an optional `limit` for
+ * one-shot use.
+ */
+
+import type { UIContext } from '@vibesdotdev/cli/providers';
+
+const SUBPROTOCOL = 'trace-v1';
+
+export interface TailRecord {
+	outcome?: string;
+	scriptName?: string;
+	eventTimestamp?: number;
+	event?: {
+		request?: { method?: string; url?: string };
+		response?: { status?: number };
+		rpcMethod?: string;
+		cron?: string;
+	};
+	logs?: Array<{ level?: string; message?: unknown[]; timestamp?: number }>;
+	exceptions?: Array<{ name?: string; message?: string; timestamp?: number }>;
+	diagnosticsChannelEvents?: unknown[];
+}
+
+function fmtTs(ts: number | undefined): string {
+	if (!ts) return new Date().toISOString();
+	return new Date(ts).toISOString();
+}
+
+function fmtArg(a: unknown): string {
+	if (a === null) return 'null';
+	if (typeof a === 'string') return a;
+	if (typeof a === 'number' || typeof a === 'boolean') return String(a);
+	try {
+		return JSON.stringify(a);
+	} catch {
+		return String(a);
+	}
+}
+
+function formatRecord(rec: TailRecord): string[] {
+	const lines: string[] = [];
+	const ts = fmtTs(rec.eventTimestamp);
+	const outcome = rec.outcome ?? 'unknown';
+	const req = rec.event?.request;
+	const res = rec.event?.response;
+	const trigger = req
+		? `${req.method ?? 'GET'} ${req.url ?? ''}${res?.status ? ` → ${res.status}` : ''}`
+		: rec.event?.cron
+			? `cron ${rec.event.cron}`
+			: rec.event?.rpcMethod
+				? `rpc ${rec.event.rpcMethod}`
+				: 'event';
+
+	lines.push(`[${ts}] ${outcome.toUpperCase()} ${rec.scriptName ?? ''} ${trigger}`);
+
+	for (const log of rec.logs ?? []) {
+		const level = (log.level ?? 'log').toLowerCase();
+		const msg = (log.message ?? []).map(fmtArg).join(' ');
+		lines.push(`  · ${level}: ${msg}`);
+	}
+	for (const ex of rec.exceptions ?? []) {
+		lines.push(`  ✖ ${ex.name ?? 'Error'}: ${ex.message ?? ''}`);
+	}
+	return lines;
+}
+
+export interface StreamTailOptions {
+	url: string;
+	ui: UIContext;
+	filterStatus?: string;
+	/** Stop after this many records (0 / undefined = stream until SIGINT). */
+	limit?: number;
+	/**
+	 * Stop after this many milliseconds, regardless of `limit`. Used by the
+	 * windowed-query mode where the CLI wants a brief batch capture instead
+	 * of an open-ended stream. When `windowMs` is set, the helper resolves
+	 * cleanly at the deadline instead of waiting for SIGINT.
+	 */
+	windowMs?: number;
+	/**
+	 * If true, captured records are not printed and are returned via the
+	 * resolved value instead. Used by windowed-query mode so the caller can
+	 * format them (e.g. as a single JSON document).
+	 */
+	collect?: boolean;
+}
+
+export type CapturedRecord = TailRecord;
+
+export async function streamWorkerTail(
+	opts: StreamTailOptions
+): Promise<CapturedRecord[]> {
+	const { url, ui, limit, windowMs, collect } = opts;
+
+	return new Promise<CapturedRecord[]>((resolve, reject) => {
+		let ws: WebSocket;
+		try {
+			ws = new WebSocket(url, [SUBPROTOCOL]);
+		} catch (err) {
+			reject(err);
+			return;
+		}
+
+		let received = 0;
+		let closed = false;
+		const captured: CapturedRecord[] = [];
+		let windowTimer: ReturnType<typeof setTimeout> | undefined;
+		const finish = (err?: Error) => {
+			if (closed) return;
+			closed = true;
+			if (windowTimer) clearTimeout(windowTimer);
+			try {
+				ws.close();
+			} catch {
+				/* ignore */
+			}
+			process.off('SIGINT', onSigint);
+			if (err) reject(err);
+			else resolve(captured);
+		};
+
+		const onSigint = () => {
+			ui.info('Tail stopped.');
+			finish();
+		};
+		process.on('SIGINT', onSigint);
+
+		ws.addEventListener('open', () => {
+			if (!collect) {
+				ui.info(
+					windowMs
+						? `Capturing logs for ${Math.round(windowMs / 1000)}s — press Ctrl+C to stop early.`
+						: 'Streaming logs — press Ctrl+C to stop.'
+				);
+			}
+			try {
+				ws.send(JSON.stringify({ debug: false }));
+			} catch (err) {
+				finish(err instanceof Error ? err : new Error(String(err)));
+				return;
+			}
+			if (windowMs && windowMs > 0) {
+				windowTimer = setTimeout(() => {
+					if (!collect) ui.info(`Capture window (${Math.round(windowMs / 1000)}s) elapsed.`);
+					finish();
+				}, windowMs);
+			}
+		});
+
+		ws.addEventListener('message', (ev: MessageEvent) => {
+			let data: string;
+			if (typeof ev.data === 'string') {
+				data = ev.data;
+			} else if (ev.data instanceof ArrayBuffer) {
+				data = new TextDecoder().decode(ev.data);
+			} else if (ev.data instanceof Uint8Array) {
+				data = new TextDecoder().decode(ev.data);
+			} else {
+				data = String(ev.data);
+			}
+			let rec: TailRecord;
+			try {
+				rec = JSON.parse(data) as TailRecord;
+			} catch {
+				if (!collect) process.stdout.write(`${data}\n`);
+				return;
+			}
+			if (collect) {
+				captured.push(rec);
+			} else {
+				for (const line of formatRecord(rec)) {
+					process.stdout.write(`${line}\n`);
+				}
+			}
+			received += 1;
+			if (limit && received >= limit) {
+				if (!collect) ui.info(`Reached limit of ${limit} records.`);
+				finish();
+			}
+		});
+
+		ws.addEventListener('error', (ev: Event) => {
+			const msg = (ev as ErrorEvent).message ?? 'tail websocket error';
+			finish(new Error(msg));
+		});
+
+		ws.addEventListener('close', (ev: CloseEvent) => {
+			if (!closed && !collect) {
+				ui.info(`Tail closed (code=${ev.code}${ev.reason ? `, reason=${ev.reason}` : ''}).`);
+			}
+			finish();
+		});
+	});
+}

package/src/cli/npm/infra-npm-publish.cli-command.descriptor.ts

@@ -0,0 +1,75 @@
+import { createRuntimeAsset } from '@vibesdotdev/runtime';
+
+export default createRuntimeAsset({
+	id: 'infra-npm.publish',
+	kind: 'cli/command',
+	name: 'publish',
+	description: 'Publish npm packages using a token resolved from vibes secrets',
+	group: 'infra-npm',
+	arguments: [
+		{
+			name: 'paths',
+			description: 'Package directories to publish (defaults to cwd)',
+			required: false,
+			variadic: true
+		}
+	],
+	options: [
+		{
+			flags: '--environment <name>',
+			description: 'Vibes secrets environment to read NPM_TOKEN from'
+		},
+		{
+			flags: '--backend <id>',
+			description: 'Specific secrets backend id to read from'
+		},
+		{
+			flags: '--token-key <key>',
+			description: 'Secret key containing the npm token',
+			default: 'NPM_TOKEN'
+		},
+		{
+			flags: '--registry <url>',
+			description: 'npm registry URL',
+			default: 'https://registry.npmjs.org'
+		},
+		{
+			flags: '--scope <scope>',
+			description: 'Scoped package registry override to write into the temporary npmrc',
+			default: '@vibesdotdev'
+		},
+		{
+			flags: '--access <access>',
+			description: 'npm access level override (public|restricted)'
+		},
+		{
+			flags: '--tag <tag>',
+			description: 'npm dist-tag',
+			default: 'latest'
+		},
+		{
+			flags: '--otp <code>',
+			description: 'One-time password for npm accounts that require publish-time 2FA'
+		},
+		{
+			flags: '--provenance',
+			description: 'Pass --provenance to npm publish'
+		},
+		{
+			flags: '--dry-run',
+			description: 'Pack and run npm publish --dry-run without requiring an npm token'
+		},
+		{
+			flags: '--yes',
+			description: 'Actually publish. Required unless --dry-run is set'
+		},
+		{
+			flags: '-o, --output <format>',
+			description: 'Output format (text|json)',
+			default: 'text'
+		}
+	],
+	surfaces: ['cli'],
+	hardware: ['consumer', 'cloud'],
+	enabled: true
+});