@vibesdotdev/infra-deploy 0.0.1

package/src/cli/npm/infra-npm-publish.cli-command.impl.ts

@@ -0,0 +1,474 @@
+import { getVibesRuntime } from '@vibesdotdev/runtime';
+import type { VibesRuntime } from '@vibesdotdev/runtime/api/runtime';
+import type { UIContext } from '@vibesdotdev/cli/providers';
+import { resolveCurrentEnvironmentConfig } from '@vibesdotdev/config/environment/current';
+import { spawnSync } from 'node:child_process';
+import { chmod, cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
+
+type SecretsStoreDescriptor = {
+	id: string;
+	backend?: string;
+	priority?: number;
+	tiers?: string[];
+};
+
+type SecretsStoreImplementation = {
+	get(environment: string, key: string): Promise<string | undefined>;
+};
+
+type PackageJson = {
+	name?: string;
+	version?: string;
+	dependencies?: Record<string, string>;
+	devDependencies?: Record<string, string>;
+	peerDependencies?: Record<string, string>;
+	optionalDependencies?: Record<string, string>;
+	publishConfig?: {
+		registry?: string;
+		access?: string;
+		tag?: string;
+	};
+};
+
+type PublishResult = {
+	name: string;
+	version: string;
+	packageDir: string;
+	tarball: string;
+	dryRun: boolean;
+	ok: boolean;
+};
+
+function readString(value: unknown): string | undefined {
+	return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
+}
+
+function readBoolean(value: unknown): boolean {
+	return value === true || value === 'true' || value === 'yes';
+}
+
+function normalizePaths(value: unknown): string[] {
+	if (Array.isArray(value)) return value.filter((item): item is string => typeof item === 'string');
+	if (typeof value === 'string' && value.length > 0) return [value];
+	return [process.cwd()];
+}
+
+async function resolveSecretsEnvironment(environmentOverride?: string): Promise<{
+	name: string;
+	tier: string;
+}> {
+	if (environmentOverride) {
+		const knownTiers = new Set(['local', 'dev', 'staging', 'production']);
+		if (knownTiers.has(environmentOverride)) {
+			return { name: environmentOverride, tier: environmentOverride };
+		}
+		try {
+			const envConfig = await resolveCurrentEnvironmentConfig();
+			return { name: environmentOverride, tier: envConfig.tier ?? 'local' };
+		} catch {
+			return { name: environmentOverride, tier: 'local' };
+		}
+	}
+
+	try {
+		const envConfig = await resolveCurrentEnvironmentConfig();
+		return { name: envConfig.name, tier: envConfig.tier ?? 'local' };
+	} catch {
+		return { name: 'local', tier: 'local' };
+	}
+}
+
+async function resolveTokenFromSecrets(
+	runtime: VibesRuntime,
+	key: string,
+	options: { environment?: string; backend?: string }
+): Promise<{ value?: string; source?: string; environment: string; tier: string }> {
+	const envValue = process.env[key];
+	if (envValue && envValue.length > 0) {
+		return { value: envValue, source: 'process.env', environment: 'process', tier: 'process' };
+	}
+
+	const environment = await resolveSecretsEnvironment(options.environment);
+	if (!runtime.hasKind('secrets/store')) {
+		return { environment: environment.name, tier: environment.tier };
+	}
+
+	const descriptors = (runtime.assets('secrets/store').descriptors() as SecretsStoreDescriptor[])
+		.filter((descriptor) => {
+			if (options.backend) return descriptor.id === options.backend;
+			if (descriptor.backend === 'encrypted-local') return true;
+			if (!descriptor.tiers || descriptor.tiers.length === 0) return true;
+			return descriptor.tiers.includes(environment.tier);
+		})
+		.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+
+	for (const descriptor of descriptors) {
+		const store = (await runtime
+			.query('secrets/store')
+			.withId(descriptor.id)
+			.resolve()) as SecretsStoreImplementation;
+		const value = await store.get(environment.name, key);
+		if (value && value.length > 0) {
+			return {
+				value,
+				source: descriptor.id,
+				environment: environment.name,
+				tier: environment.tier
+			};
+		}
+	}
+
+	return { environment: environment.name, tier: environment.tier };
+}
+
+async function readPackageJson(packageDir: string): Promise<PackageJson & { name: string; version: string }> {
+	const raw = await readFile(join(packageDir, 'package.json'), 'utf8');
+	const parsed = JSON.parse(raw) as PackageJson;
+	if (!parsed.name || !parsed.version) {
+		throw new Error(`${packageDir}/package.json must include name and version`);
+	}
+	return { ...parsed, name: parsed.name, version: parsed.version };
+}
+
+async function pathExists(path: string): Promise<boolean> {
+	try {
+		await stat(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+async function findWorkspaceRoot(startDir: string): Promise<string> {
+	let current = resolve(startDir);
+	while (true) {
+		const packagePath = join(current, 'package.json');
+		if (await pathExists(packagePath)) {
+			try {
+				const parsed = JSON.parse(await readFile(packagePath, 'utf8')) as { workspaces?: unknown };
+				if (parsed.workspaces) return current;
+			} catch {
+				// Keep walking; malformed package.json will be reported elsewhere.
+			}
+		}
+		const parent = dirname(current);
+		if (parent === current) return resolve(startDir);
+		current = parent;
+	}
+}
+
+async function collectWorkspaceVersions(workspaceRoot: string): Promise<Map<string, string>> {
+	const versions = new Map<string, string>();
+	const roots = ['packages', 'libraries', 'apps'].map((entry) => join(workspaceRoot, entry));
+
+	async function walk(dir: string): Promise<void> {
+		let entries;
+		try {
+			entries = await readdir(dir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+
+		const packagePath = join(dir, 'package.json');
+		if (await pathExists(packagePath)) {
+			try {
+				const parsed = JSON.parse(await readFile(packagePath, 'utf8')) as PackageJson;
+				if (parsed.name && parsed.version) versions.set(parsed.name, parsed.version);
+			} catch {
+				// Ignore here; the package being published is parsed separately.
+			}
+			return;
+		}
+
+		for (const entry of entries) {
+			if (!entry.isDirectory()) continue;
+			if (entry.name === 'node_modules' || entry.name === '.git' || entry.name === 'dist') continue;
+			await walk(join(dir, entry.name));
+		}
+	}
+
+	for (const root of roots) await walk(root);
+	return versions;
+}
+
+function rewriteWorkspaceDependencyVersions(pkg: PackageJson, versions: Map<string, string>): PackageJson {
+	const fields = ['dependencies', 'peerDependencies', 'optionalDependencies'] as const;
+	const next: PackageJson = { ...pkg };
+
+	for (const field of fields) {
+		const deps = next[field];
+		if (!deps) continue;
+		next[field] = { ...deps };
+		for (const [name, range] of Object.entries(deps)) {
+			if (!range.startsWith('workspace:')) continue;
+			const version = versions.get(name);
+			if (!version) {
+				throw new Error(`Cannot rewrite ${name}@${range}; workspace package version not found`);
+			}
+			next[field]![name] = version;
+		}
+	}
+
+	delete next.devDependencies;
+	return next;
+}
+
+async function stagePackageForPublish(options: {
+	packageDir: string;
+	stageDir: string;
+	versions: Map<string, string>;
+}): Promise<void> {
+	await cp(options.packageDir, options.stageDir, {
+		recursive: true,
+		filter: (source) => {
+			const name = basename(source);
+			return ![
+				'node_modules',
+				'.git',
+				'.turbo',
+				'.svelte-kit'
+			].includes(name) && !name.endsWith('.tgz');
+		}
+	});
+
+	const packagePath = join(options.stageDir, 'package.json');
+	const pkg = JSON.parse(await readFile(packagePath, 'utf8')) as PackageJson;
+	const rewritten = rewriteWorkspaceDependencyVersions(pkg, options.versions);
+	await writeFile(packagePath, `${JSON.stringify(rewritten, null, 2)}\n`);
+}
+
+function npmBin(): string {
+	return process.platform === 'win32' ? 'npm.cmd' : 'npm';
+}
+
+function runNpm(args: string[], options: { cwd: string; env?: NodeJS.ProcessEnv }): void {
+	const child = spawnSync(npmBin(), args, {
+		cwd: options.cwd,
+		stdio: 'inherit',
+		env: options.env ?? process.env
+	});
+	if (child.error) throw child.error;
+	if (child.status !== 0) {
+		throw new Error(`npm ${args.join(' ')} failed with exit ${child.status ?? 'unknown'}`);
+	}
+}
+
+async function newestTarball(dir: string): Promise<string> {
+	const entries = await readdir(dir);
+	const tarballs = entries.filter((entry) => entry.endsWith('.tgz')).sort();
+	if (tarballs.length !== 1) {
+		throw new Error(`Expected one packed tarball in ${dir}, found ${tarballs.length}`);
+	}
+	return join(dir, tarballs[0]);
+}
+
+function authConfigLine(registry: string): string {
+	const url = new URL(registry);
+	const path = url.pathname.endsWith('/') ? url.pathname : `${url.pathname}/`;
+	return `//${url.host}${path}:_authToken`;
+}
+
+function sanitizeNpmEnv(extra: Record<string, string>): NodeJS.ProcessEnv {
+	const env: NodeJS.ProcessEnv = { ...process.env };
+	delete env.NPM_TOKEN;
+	delete env.NODE_AUTH_TOKEN;
+	delete env.NPM_CONFIG_USERCONFIG;
+	delete env.NPM_CONFIG_REGISTRY;
+	for (const [key, value] of Object.entries(extra)) env[key] = value;
+	return env;
+}
+
+async function writeTempNpmrc(options: {
+	path: string;
+	registry: string;
+	scope?: string;
+	token?: string;
+}): Promise<void> {
+	const lines = [
+		`registry=${options.registry}`,
+		options.scope ? `${options.scope}:registry=${options.registry}` : undefined,
+		options.token ? `${authConfigLine(options.registry)}=${options.token}` : undefined
+	].filter((line): line is string => Boolean(line));
+	await writeFile(options.path, `${lines.join('\n')}\n`, { mode: 0o600 });
+	await chmod(options.path, 0o600);
+}
+
+function publishArgs(options: {
+	tarball: string;
+	registry: string;
+	access?: string;
+	tag?: string;
+	otp?: string;
+	provenance: boolean;
+	dryRun: boolean;
+}): string[] {
+	const args = ['publish', options.tarball, '--registry', options.registry];
+	if (options.access) args.push('--access', options.access);
+	if (options.tag) args.push('--tag', options.tag);
+	if (options.otp) args.push('--otp', options.otp);
+	if (options.provenance) args.push('--provenance');
+	if (options.dryRun) args.push('--dry-run');
+	return args;
+}
+
+async function publishPackage(options: {
+	packageDir: string;
+	registry: string;
+	scope?: string;
+	access?: string;
+	tag?: string;
+	otp?: string;
+	provenance: boolean;
+	dryRun: boolean;
+	token?: string;
+	ui: UIContext;
+	versions: Map<string, string>;
+}): Promise<PublishResult> {
+	const packageDir = isAbsolute(options.packageDir)
+		? options.packageDir
+		: resolve(process.cwd(), options.packageDir);
+	const pkg = await readPackageJson(packageDir);
+	const registry = options.registry || pkg.publishConfig?.registry || 'https://registry.npmjs.org';
+	const access = options.access ?? pkg.publishConfig?.access;
+	const tag = options.tag ?? pkg.publishConfig?.tag;
+	const tempRoot = await mkdtemp(join(tmpdir(), 'vibes-npm-publish-'));
+	const packDir = join(tempRoot, 'pack');
+	const stageDir = join(tempRoot, 'stage');
+	const npmrcPath = join(tempRoot, 'npmrc');
+	const homeDir = join(tempRoot, 'home');
+
+	try {
+		await mkdir(packDir, { recursive: true });
+		await mkdir(homeDir, { recursive: true });
+		await stagePackageForPublish({ packageDir, stageDir, versions: options.versions });
+		await writeTempNpmrc({
+			path: npmrcPath,
+			registry,
+			scope: options.scope,
+			token: options.token
+		});
+
+		options.ui.info(`Packing ${pkg.name}@${pkg.version} from ${packageDir}`);
+		runNpm(['pack', '--ignore-scripts', '--pack-destination', packDir], { cwd: stageDir });
+		const tarball = await newestTarball(packDir);
+
+		const env = sanitizeNpmEnv({
+			NPM_CONFIG_USERCONFIG: npmrcPath,
+			HOME: homeDir,
+			USERPROFILE: homeDir
+		});
+		const args = publishArgs({
+			tarball,
+			registry,
+			access,
+			tag,
+			otp: options.otp,
+			provenance: options.provenance,
+			dryRun: options.dryRun
+		});
+		options.ui.info(
+			`${options.dryRun ? 'Dry-running publish' : 'Publishing'} ${pkg.name}@${pkg.version} to ${registry}`
+		);
+		runNpm(args, { cwd: tempRoot, env });
+
+		return {
+			name: pkg.name,
+			version: pkg.version,
+			packageDir,
+			tarball: basename(tarball),
+			dryRun: options.dryRun,
+			ok: true
+		};
+	} finally {
+		await rm(tempRoot, { recursive: true, force: true });
+	}
+}
+
+export default {
+	async execute(args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
+		const runtime = getVibesRuntime();
+		const ui = (await runtime.context('cli/ui')) as UIContext;
+		const output = readString(opts.output) ?? 'text';
+		const dryRun = readBoolean(opts.dryRun);
+		const yes = readBoolean(opts.yes);
+		const tokenKey = readString(opts.tokenKey) ?? 'NPM_TOKEN';
+		const registry = readString(opts.registry) ?? 'https://registry.npmjs.org';
+		const scope = readString(opts.scope);
+		const packagePaths = normalizePaths(args.paths);
+		const workspaceRoot = await findWorkspaceRoot(process.cwd());
+		const versions = await collectWorkspaceVersions(workspaceRoot);
+
+		if (!dryRun && !yes) {
+			ui.error('Refusing to publish without --yes. Use --dry-run to test without publishing.');
+			process.exitCode = 1;
+			return;
+		}
+
+		let token: string | undefined;
+		let tokenSource: string | undefined;
+		let tokenEnvironment = 'local';
+		let tokenTier = 'local';
+		if (!dryRun) {
+			const resolved = await resolveTokenFromSecrets(runtime, tokenKey, {
+				environment: readString(opts.environment),
+				backend: readString(opts.backend)
+			});
+			token = resolved.value;
+			tokenSource = resolved.source;
+			tokenEnvironment = resolved.environment;
+			tokenTier = resolved.tier;
+			if (!token) {
+				ui.error(
+					`Missing ${tokenKey}. Store it with \`vibes secrets set ${tokenKey} --environment ${tokenEnvironment}\` and rerun.`
+				);
+				ui.info('Create a publish token at https://www.npmjs.com/settings/tokens');
+				process.exitCode = 1;
+				return;
+			}
+			ui.info(`Resolved ${tokenKey} from ${tokenSource} (${tokenEnvironment}/${tokenTier}).`);
+		}
+
+		const results: PublishResult[] = [];
+		try {
+			for (const packagePath of packagePaths) {
+				results.push(
+					await publishPackage({
+						packageDir: packagePath,
+						registry,
+						scope,
+						access: readString(opts.access),
+						tag: readString(opts.tag),
+						otp: readString(opts.otp),
+						provenance: readBoolean(opts.provenance),
+						dryRun,
+						token,
+						ui,
+						versions
+					})
+				);
+			}
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			if (output === 'json') {
+				ui.json({ ok: false, error: message, results });
+			} else {
+				ui.error(message);
+			}
+			process.exitCode = 1;
+			return;
+		}
+
+		if (output === 'json') {
+			ui.json({ ok: true, dryRun, results });
+			return;
+		}
+
+		ui.success(
+			dryRun
+				? `npm publish dry-run completed for ${results.length} package(s).`
+				: `Published ${results.length} npm package(s).`
+		);
+	}
+};

package/src/cli/npm/infra-npm.cli-group.descriptor.ts

@@ -0,0 +1,12 @@
+import { createRuntimeAsset } from '@vibesdotdev/runtime';
+
+export default createRuntimeAsset({
+	id: 'infra-npm',
+	kind: 'cli/group',
+	name: 'npm',
+	description: 'npm registry publishing commands',
+	parent: 'infra',
+	surfaces: ['cli'],
+	hardware: ['consumer', 'cloud'],
+	enabled: true
+});

package/src/cli/observability/infra-observability-set.cli-command.descriptor.ts

@@ -0,0 +1,57 @@
+import { createRuntimeAsset } from '@vibesdotdev/runtime';
+
+export default createRuntimeAsset({
+	id: 'infra-observability.set',
+	kind: 'cli/command',
+	name: 'set',
+	description: 'Update observability config (sampling, logs/traces enabled) on Worker(s)',
+	group: 'infra-observability',
+	options: [
+		{
+			flags: '--worker <name>',
+			description: 'Scope to a single Worker (omit for fleet-wide apply)'
+		},
+		{
+			flags: '--filter <glob>',
+			description: 'Glob to narrow the fleet apply (e.g. "vibes-*")'
+		},
+		{
+			flags: '--sampling <rate>',
+			description: 'Logs head sampling rate (0..1; e.g. 0.1 for 10%)'
+		},
+		{
+			flags: '--logs <enabled>',
+			description: 'Enable/disable logs (true|false)'
+		},
+		{
+			flags: '--traces <enabled>',
+			description: 'Enable/disable traces (true|false)'
+		},
+		{
+			flags: '--provider <id>',
+			description: 'Provider impl id (default: cloudflare-workers-observability)'
+		},
+		{
+			flags: '--environment <name>',
+			description: 'Vibes environment for secret resolution (local|dev|staging|production)'
+		},
+		{
+			flags: '--dry-run',
+			description: 'Show what would change; do not write',
+			default: false
+		},
+		{
+			flags: '-y, --yes',
+			description: 'Skip confirmation prompt for multi-worker changes',
+			default: false
+		},
+		{
+			flags: '-o, --output <format>',
+			description: 'Output format (text|json)',
+			default: 'text'
+		}
+	],
+	surfaces: ['cli'],
+	hardware: ['consumer', 'cloud'],
+	enabled: true
+});