@vibesdotdev/infra-deploy 0.0.1

package/src/cli/run/infra-deploy.run.cli-command.impl.ts

@@ -0,0 +1,330 @@
+import { getVibesRuntime } from '@vibesdotdev/runtime';
+import type { UIContext } from '@vibesdotdev/cli/providers';
+import { resolveCurrentEnvironmentConfig } from '@vibesdotdev/config/environment/current';
+import { resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { getCloudflareWorkersDeployClient } from '@vibesdotdev/connector-cloudflare/client';
+import { getDigitalOceanAppDeployClient } from '@vibesdotdev/infra-doks/client';
+import { loadDeploymentConfig } from '../../config-loader.ts';
+import { regenerateApp } from '../../regenerate.ts';
+
+function readString(v: unknown): string | undefined {
+	return typeof v === 'string' && v.length > 0 ? v : undefined;
+}
+function readBoolean(v: unknown): boolean {
+	return v === true || v === 'true';
+}
+
+function resolveWorkspaceRoot(
+	workspaceRootDir: string | undefined,
+	appDir: string,
+	override: string | undefined
+): string {
+	if (override) return resolve(override);
+	if (!workspaceRootDir || workspaceRootDir === '.') return process.cwd();
+	return resolve(appDir, workspaceRootDir);
+}
+
+const CLOUDFLARE_API_TOKEN_KEY = 'CLOUDFLARE_API_TOKEN';
+const CLOUDFLARE_ACCOUNT_ID_KEY = 'CLOUDFLARE_ACCOUNT_ID';
+
+async function resolveCloudflareEnvFromSecretsStore(
+	runtime: ReturnType<typeof getVibesRuntime>,
+	ui: UIContext,
+	environmentOverride?: string
+): Promise<Record<string, string>> {
+	if (process.env.CLOUDFLARE_API_TOKEN && process.env.CLOUDFLARE_ACCOUNT_ID) {
+		return {};
+	}
+	if (!runtime.hasKind('secrets/store')) {
+		throw new Error(
+			`Missing secrets/store kind in runtime. Enable secrets backends via plugin config ` +
+			`(for example plugins.auth.secrets=true and plugins.auth.secretsBackends.*) before running deploy.`
+		);
+	}
+
+	let envName = environmentOverride ?? 'local';
+	let envTier = 'local';
+	if (environmentOverride) {
+		envTier = environmentOverride;
+	} else {
+		try {
+			const envConfig = await resolveCurrentEnvironmentConfig();
+			envName = envConfig.name;
+			envTier = envConfig.tier ?? 'local';
+		} catch {
+			// Fall back to local when config environment resolution is unavailable.
+		}
+	}
+
+	const descriptors = runtime.assets('secrets/store').descriptors() as Array<{
+		id: string;
+		priority?: number;
+		tiers?: string[];
+	}>;
+	const tierCandidates = new Set([envTier]);
+	if (envTier === 'local' || envTier === 'dev') {
+		// Deploy auth is often run from local shells while credentials live in
+		// staging/production backends (Vault/Cloudflare). Include those tiers as
+		// fallbacks instead of hard-filtering them out.
+		tierCandidates.add('staging');
+		tierCandidates.add('production');
+	}
+	const candidates = descriptors
+		.filter((d) => {
+			if (environmentOverride) return true;
+			if (!d.tiers || d.tiers.length === 0) return true;
+			return d.tiers.some((tier) => tierCandidates.has(tier));
+		})
+		.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+
+	const out: Record<string, string> = {};
+	for (const descriptor of candidates) {
+		const store = (await runtime
+			.query('secrets/store')
+			.withId(descriptor.id)
+			.resolve()) as {
+			get(environment: string, key: string): Promise<string | undefined>;
+		};
+
+		if (!process.env.CLOUDFLARE_API_TOKEN && !out.CLOUDFLARE_API_TOKEN) {
+			const value = await store.get(envName, CLOUDFLARE_API_TOKEN_KEY);
+			if (value && value.length > 0) {
+				out.CLOUDFLARE_API_TOKEN = value;
+			}
+		}
+
+		if (!process.env.CLOUDFLARE_ACCOUNT_ID && !out.CLOUDFLARE_ACCOUNT_ID) {
+			const value = await store.get(envName, CLOUDFLARE_ACCOUNT_ID_KEY);
+			if (value && value.length > 0) {
+				out.CLOUDFLARE_ACCOUNT_ID = value;
+			}
+		}
+
+		if (out.CLOUDFLARE_API_TOKEN && out.CLOUDFLARE_ACCOUNT_ID) break;
+	}
+
+	if (Object.keys(out).length > 0) {
+		ui.info(
+			`Resolved Cloudflare deploy credentials from secrets store (${envName}/${envTier}).`
+		);
+	}
+	return out;
+}
+
+export default {
+	async execute(args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
+		const runtime = getVibesRuntime();
+		const ui = (await runtime.context('cli/ui')) as UIContext;
+
+		const pathArg = readString(args.path) ?? process.cwd();
+		const output = readString(opts.output) ?? 'text';
+		const skipBuild = readBoolean(opts.skipBuild);
+		const skipD1Migrations = readBoolean(opts.skipD1Migrations);
+		const dryRun = readBoolean(opts.dryRun);
+		const workspaceRootOverride = readString(opts.workspaceRoot);
+		const targetEnvironment = readString(opts.environment);
+		let loaded;
+		try {
+			loaded = await loadDeploymentConfig(pathArg);
+		} catch (err) {
+			ui.error(`Failed to load deployment config: ${(err as Error).message}`);
+			process.exitCode = 1;
+			return;
+		}
+
+		const { deployment, provider, appDir } = loaded;
+		if (output === 'text') {
+			ui.info(`Deploying ${deployment.appName} (${deployment.appId}) via ${provider}`);
+		}
+
+		const onLine = (_stream: 'stdout' | 'stderr', line: string) => {
+			if (output === 'text') ui.log(line);
+		};
+
+		try {
+			switch (provider) {
+				case 'cloudflare-workers': {
+					const environment = readString(opts.wranglerEnv);
+					const workspaceRoot = resolveWorkspaceRoot(
+						deployment.build.workspaceRootDir,
+						appDir,
+						workspaceRootOverride
+					);
+
+					// Run generic pre-deploy commands (provider-agnostic hooks)
+					if (deployment.preDeployCommands.length > 0) {
+						onLine('stdout', `Running ${deployment.preDeployCommands.length} pre-deploy command(s)...`);
+						for (const cmd of deployment.preDeployCommands) {
+							if (cmd.description) {
+								onLine('stdout', `  ${cmd.description}`);
+							}
+							if (dryRun) {
+								onLine('stdout', `  [dry-run] ${cmd.command}`);
+								continue;
+							}
+							const [bin, ...args] = cmd.command.split(' ').filter(Boolean);
+							if (!bin) continue;
+							const child = spawnSync(bin, args, {
+								cwd: appDir,
+								stdio: 'inherit',
+								env: process.env
+							});
+							if (child.status !== 0) {
+								throw new Error(
+									`Pre-deploy command failed: ${cmd.command} (exit=${child.status ?? child.error?.message ?? 'unknown'})`
+								);
+							}
+						}
+						onLine('stdout', 'Pre-deploy commands complete.');
+					}
+
+					// Regen gate: refuse to deploy a stale wrangler.jsonc. For apps with
+					// `managed: true` in deployment.config.ts, this enforces that what's
+					// on disk matches what the typed config would produce. Unmanaged apps
+					// pass through (the gate is opt-in until every app is migrated).
+					const regen = await regenerateApp(appDir, { mode: 'check' });
+					if (regen.status === 'drift') {
+						const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+						const isKvIdDrift =
+							regen.diff &&
+							/^[\+\-]\s+"id":\s*"[^"]*"/m.test(regen.diff) &&
+							!uuidRe.test(regen.diff.replace(/"id":\s*"([^"]*)"/g, '$1').slice(0, 36));
+						if (!isKvIdDrift) {
+							const detail = regen.diff ? `\n${regen.diff}` : '';
+							throw new Error(
+								`wrangler.jsonc drift for ${regen.appId} — regenerate before deploy (run \`vibes infra deploy regenerate ${appDir}\`)${detail}`
+							);
+						}
+						onLine('stdout', `[regen] wrangler.jsonc verified (unchanged — kv namespace IDs resolved)`);
+					}
+					if (regen.status === 'error') {
+						throw new Error(
+							`regenerate check failed for ${appDir}: ${regen.reason ?? 'unknown error'}`
+						);
+					}
+					if (regen.status === 'updated' || regen.status === 'unchanged') {
+						onLine('stdout', `[regen] wrangler.jsonc verified (${regen.status})`);
+					} else if (regen.status === 'skipped') {
+						onLine('stdout', `[regen] skipped: ${regen.reason ?? 'not managed'}`);
+					}
+
+					const client = await getCloudflareWorkersDeployClient();
+					const envOverrides = await resolveCloudflareEnvFromSecretsStore(
+						runtime,
+						ui,
+						targetEnvironment
+					);
+
+					// Provisioning for KV, D1, R2 is now always attempted when declared
+					// (creation + ID reconciliation happens in the client using REST API).
+					// Migrations remain opt-in via autoMigrateD1 for safety.
+					const rawConfig = loaded.raw as Record<string, unknown>;
+					const autoMigrateD1 = rawConfig.autoMigrateD1 === true && !skipD1Migrations;
+					if (skipD1Migrations) {
+						onLine('stdout', 'Skipping D1 migrations for this deploy.');
+					}
+					const generatedWranglerConfig =
+						typeof rawConfig.generateWranglerConfig === 'function'
+							? (rawConfig.generateWranglerConfig() as Record<string, unknown>)
+							: loaded.wranglerJsoncString
+								? (JSON.parse(
+										loaded.wranglerJsoncString.replace(/^\s*\/\/.*$/gm, '')
+									) as Record<string, unknown>)
+								: rawConfig;
+
+					const d1Databases =
+						((rawConfig.d1Databases ??
+							rawConfig.d1_databases ??
+							generatedWranglerConfig.d1Databases ??
+							generatedWranglerConfig.d1_databases) as
+							| Array<{ binding: string; database_name: string; migrations_dir?: string }>
+							| undefined) ?? undefined;
+
+					const r2Buckets = (rawConfig.r2_buckets as
+						| Array<{ binding?: string; bucket_name: string }>
+						| undefined) ?? undefined;
+
+					const result = await client.deployWorker({
+						appDir,
+						workspaceRoot,
+						workerName: deployment.appId,
+						buildCommand: deployment.build.buildCommand,
+						skipBuild,
+						dryRun,
+						environment,
+						envOverrides,
+						kvNamespaces: (deployment as Record<string, unknown>).kvNamespaces as
+							| Array<{ binding: string; id: string; preview_id?: string }>
+							| undefined,
+						d1Databases: autoMigrateD1 ? d1Databases : undefined,
+						r2Buckets,
+						onLine
+					});
+
+					if (output === 'json') {
+						ui.json({
+							ok: true,
+							provider: 'cloudflare-workers',
+							workerName: result.workerName,
+							deployedUrl: result.deployedUrl
+						});
+					} else if (!dryRun) {
+						ui.success(
+							result.deployedUrl
+								? `Deployed Worker ${result.workerName} at ${result.deployedUrl}`
+								: `Deployed Worker ${result.workerName}`
+						);
+					}
+					return;
+				}
+				case 'digitalocean-app': {
+					const doAppId = readString(opts.doAppId);
+					const doRegion = readString(opts.doRegion);
+					const doGitRepo = readString(opts.doGitRepo);
+					const doGitBranch = readString(opts.doGitBranch);
+
+					const client = await getDigitalOceanAppDeployClient();
+					const result = await client.deployApp({
+						deployment,
+						appId: doAppId,
+						region: doRegion,
+						git: doGitRepo ? { repoCloneUrl: doGitRepo, branch: doGitBranch ?? 'main' } : undefined,
+						dryRun,
+						onLine
+					});
+
+					if (output === 'json') {
+						ui.json({
+							ok: true,
+							provider: 'digitalocean-app',
+							appId: result.appId,
+							liveUrl: result.liveUrl
+						});
+					} else if (!dryRun) {
+						ui.success(
+							result.liveUrl
+								? `Deployed DO App ${result.appId} at ${result.liveUrl}`
+								: `Deployed DO App ${result.appId}`
+						);
+					}
+					return;
+				}
+				default: {
+					ui.error(`Unsupported provider: ${provider}`);
+					ui.info('Supported providers: cloudflare-workers, digitalocean-app');
+					process.exitCode = 1;
+					return;
+				}
+			}
+		} catch (err) {
+			const message = (err as Error).message;
+			if (output === 'json') {
+				ui.json({ ok: false, error: message });
+			} else {
+				ui.error(message);
+			}
+			process.exitCode = 1;
+		}
+	}
+};

package/src/cli/shared/discover-deployments.ts

@@ -0,0 +1,127 @@
+/**
+ * Discover deployed apps in a workspace by scanning for `deployment.config.ts`
+ * files. Used by infra CLI commands that need the live inventory of deployed
+ * workers/sites without hardcoding app names in framework packages.
+ */
+
+import { readdir, stat } from 'node:fs/promises';
+import { join, isAbsolute, resolve } from 'node:path';
+import type { DeploymentDependency } from '@vibesdotdev/infra-core/deployment';
+import { loadDeploymentConfig } from '../../config-loader.ts';
+
+const CONFIG_NAMES = new Set([
+	'deployment.config.ts',
+	'deployment.config.js',
+	'deployment.config.mjs'
+]);
+
+const IGNORED_DIRS = new Set([
+	'node_modules',
+	'.git',
+	'.svelte-kit',
+	'dist',
+	'.next',
+	'.turbo',
+	'.vite',
+	'.wrangler'
+]);
+
+export interface DiscoveredDeployment {
+	appId: string;
+	appName: string;
+	provider: string;
+	appDir: string;
+	workerName: string | null;
+	dependsOn: DeploymentDependency[];
+}
+
+export interface DiscoverErrorInfo {
+	configPath: string;
+	appDir: string;
+	error: Error;
+}
+
+export interface DiscoverOptions {
+	/** Root to scan. Absolute, or relative to cwd. Defaults to cwd. */
+	root?: string;
+	/** Max directory depth. Defaults to 4. */
+	maxDepth?: number;
+	/** When set, only return deployments whose provider matches. */
+	provider?: string;
+	/**
+	 * Invoked once per config that fails to load. The default behavior is to
+	 * silently skip — `vibes infra deploy list` overrides this to surface
+	 * unparseable rows.
+	 */
+	onError?: (info: DiscoverErrorInfo) => void;
+}
+
+async function findConfigs(root: string, maxDepth: number): Promise<string[]> {
+	const found: string[] = [];
+	async function walk(dir: string, depth: number): Promise<void> {
+		if (depth > maxDepth) return;
+		let entries: string[];
+		try {
+			entries = await readdir(dir);
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			if (CONFIG_NAMES.has(entry)) found.push(join(dir, entry));
+		}
+		for (const entry of entries) {
+			if (IGNORED_DIRS.has(entry) || entry.startsWith('.')) continue;
+			const full = join(dir, entry);
+			let info;
+			try {
+				info = await stat(full);
+			} catch {
+				continue;
+			}
+			if (info.isDirectory()) await walk(full, depth + 1);
+		}
+	}
+	await walk(root, 0);
+	return found;
+}
+
+/**
+ * Scan `root` for every `deployment.config.ts` and return the loaded
+ * deployment descriptors. Configs that fail to load are skipped; pass
+ * `onError` to be notified about each failure (e.g. to render
+ * `(unparseable)` rows in the list command).
+ */
+export async function discoverDeployments(
+	opts: DiscoverOptions = {}
+): Promise<DiscoveredDeployment[]> {
+	const rootInput = opts.root ?? process.cwd();
+	const root = isAbsolute(rootInput) ? rootInput : resolve(process.cwd(), rootInput);
+	const maxDepth = opts.maxDepth ?? 4;
+
+	const configPaths = await findConfigs(root, maxDepth);
+	const results: DiscoveredDeployment[] = [];
+
+	for (const configPath of configPaths) {
+		const appDir = configPath.replace(/\/deployment\.config\.(ts|js|mjs)$/, '');
+		try {
+			const loaded = await loadDeploymentConfig(appDir);
+			if (opts.provider && loaded.provider !== opts.provider) continue;
+			results.push({
+				appId: loaded.deployment.appId,
+				appName: loaded.deployment.appName,
+				provider: loaded.provider,
+				appDir: loaded.appDir,
+				workerName: loaded.workerName,
+				dependsOn: loaded.deployment.dependsOn ?? []
+			});
+		} catch (err) {
+			opts.onError?.({
+				configPath,
+				appDir,
+				error: err instanceof Error ? err : new Error(String(err))
+			});
+		}
+	}
+
+	return results;
+}

package/src/config-loader.ts

@@ -0,0 +1,179 @@
+import { resolve, isAbsolute, join, dirname } from 'node:path';
+import { existsSync, statSync } from 'node:fs';
+import { spawn } from 'node:child_process';
+import type { AppDeployment } from '@vibesdotdev/infra-core/deployment';
+
+export interface LoadedDeployment {
+	configPath: string;
+	appDir: string;
+	deployment: AppDeployment;
+	provider: string;
+	raw: unknown;
+	/**
+	 * Canonical wrangler.jsonc render output, when the default export is a
+	 * managed Cloudflare web-app deployment (see
+	 * `@vibesdotdev/infra-cloudflare/regen`). `null` when the export isn't
+	 * a managed deployment — used by the regen orchestrator to gate writes
+	 * and the CI drift check.
+	 */
+	wranglerJsoncString: string | null;
+	/** Mirrors `webAppDeployment.managed`; `false` when not a managed export. */
+	managed: boolean;
+	/** Cloudflare Workers script name, when emitted by the managed export. */
+	workerName: string | null;
+}
+
+const CONFIG_FILENAMES = ['deployment.config.ts', 'deployment.config.js', 'deployment.config.mjs'];
+
+export function resolveAppDir(input: string): string {
+	const absolute = isAbsolute(input) ? input : resolve(process.cwd(), input);
+	if (!existsSync(absolute)) {
+		throw new Error(`Path does not exist: ${absolute}`);
+	}
+	const stat = statSync(absolute);
+	if (!stat.isDirectory()) {
+		throw new Error(`Expected directory, got file: ${absolute}`);
+	}
+	return absolute;
+}
+
+export function findConfigFile(appDir: string): string {
+	for (const name of CONFIG_FILENAMES) {
+		const candidate = join(appDir, name);
+		if (existsSync(candidate)) return candidate;
+	}
+	throw new Error(
+		`No deployment config found in ${appDir}. Expected one of: ${CONFIG_FILENAMES.join(', ')}`
+	);
+}
+
+function extractDeployment(raw: unknown): { deployment: AppDeployment; provider: string } {
+	if (!raw || typeof raw !== 'object') {
+		throw new Error('deployment.config default export must be an object');
+	}
+	const record = raw as Record<string, unknown>;
+	const deployment = (record.deployment ?? record) as AppDeployment | undefined;
+	if (!deployment || typeof deployment !== 'object' || !('appId' in deployment)) {
+		throw new Error('deployment.config must export an AppDeployment (or { deployment })');
+	}
+	const provider = (deployment as AppDeployment).provider;
+	if (!provider || typeof provider !== 'string') {
+		throw new Error('deployment.provider is required');
+	}
+	return { deployment: deployment as AppDeployment, provider };
+}
+
+/**
+ * Walk upward from `from` looking for the workspace root (the directory
+ * with a `bun.lock` or `package.json` containing `workspaces`).
+ */
+function findWorkspaceRoot(from: string): string {
+	let dir = from;
+	while (dir !== dirname(dir)) {
+		if (existsSync(join(dir, 'bun.lock'))) return dir;
+		const pkgPath = join(dir, 'package.json');
+		if (existsSync(pkgPath)) {
+			try {
+				const pkg = JSON.parse(require('node:fs').readFileSync(pkgPath, 'utf8'));
+				if (pkg.workspaces) return dir;
+			} catch {
+				// not a parseable package.json; keep walking
+			}
+		}
+		dir = dirname(dir);
+	}
+	return from;
+}
+
+interface SubprocessOutput {
+	raw: unknown;
+	render: {
+		managed: boolean;
+		rendered: string | null;
+		workerName: string | null;
+	};
+}
+
+/**
+ * Load a deployment.config.ts via a `bun` subprocess from the workspace
+ * root. Direct `await import(configPath)` doesn't work when the compiled
+ * `vibes` binary runs against a workspace symlink — its bundled module
+ * resolver has no idea where `@vibesdotdev/infra-core` lives. Subprocess
+ * inherits the workspace's bun (path + node_modules), so workspace
+ * package imports resolve as if you ran `bun apps/<app>/deployment.config.ts`
+ * directly.
+ *
+ * The subprocess also tries to import `@vibesdotdev/infra-cloudflare/web-app`
+ * and call `renderWranglerJsoncFromDefaultExport(raw)` so the canonical
+ * wrangler.jsonc string is returned alongside the raw config. This lets
+ * the regen orchestrator stay agnostic of provider-specific rendering.
+ * If the import fails (SDK consumer without infra-cloudflare in their
+ * tree), the render block is reported as `{ managed: false, rendered: null }`.
+ */
+async function loadConfigViaSubprocess(
+	configPath: string,
+	workspaceRoot: string
+): Promise<SubprocessOutput> {
+	return new Promise((resolvePromise, reject) => {
+		const script = `
+			const mod = await import(${JSON.stringify(configPath)});
+			const raw = mod.default ?? mod;
+			let render = { managed: false, rendered: null, workerName: null };
+			try {
+				const cf = await import('@vibesdotdev/infra-cloudflare/web-app');
+				if (typeof cf.renderWranglerJsoncFromDefaultExport === 'function') {
+					render = cf.renderWranglerJsoncFromDefaultExport(raw);
+				}
+			} catch (_) {
+				// infra-cloudflare not resolvable; leave render as the default null block.
+			}
+			process.stdout.write(JSON.stringify({ raw, render }));
+		`;
+		const child = spawn('bun', ['--bun', '-e', script], {
+			cwd: workspaceRoot,
+			stdio: ['ignore', 'pipe', 'pipe']
+		});
+		let stdout = '';
+		let stderr = '';
+		child.stdout?.on('data', (chunk) => (stdout += String(chunk)));
+		child.stderr?.on('data', (chunk) => (stderr += String(chunk)));
+		child.on('error', reject);
+		child.on('close', (code) => {
+			if (code !== 0) {
+				reject(
+					new Error(
+						`bun subprocess exited with code ${code}\nstderr: ${stderr.trim()}\nstdout: ${stdout.trim()}`
+					)
+				);
+				return;
+			}
+			try {
+				resolvePromise(JSON.parse(stdout) as SubprocessOutput);
+			} catch (err) {
+				reject(
+					new Error(
+						`Failed to parse subprocess JSON output: ${err instanceof Error ? err.message : String(err)}\nstdout: ${stdout.slice(0, 500)}`
+					)
+				);
+			}
+		});
+	});
+}
+
+export async function loadDeploymentConfig(appDir: string): Promise<LoadedDeployment> {
+	const dir = resolveAppDir(appDir);
+	const configPath = findConfigFile(dir);
+	const workspaceRoot = findWorkspaceRoot(dir);
+	const output = await loadConfigViaSubprocess(configPath, workspaceRoot);
+	const { deployment, provider } = extractDeployment(output.raw);
+	return {
+		configPath,
+		appDir: dir,
+		deployment,
+		provider,
+		raw: output.raw,
+		wranglerJsoncString: output.render.rendered,
+		managed: output.render.managed,
+		workerName: output.render.workerName
+	};
+}

package/src/index.ts

@@ -0,0 +1,11 @@
+export { default as infraDeployPlugin } from './infra-deploy.plugin';
+export { loadDeploymentConfig } from './config-loader.ts';
+export type { LoadedDeployment } from './config-loader.ts';
+export {
+	regenerateApp,
+	regenerateAll,
+	regenExitCode,
+	type RegenResult,
+	type RegenStatus,
+	type RegenerateOptions
+} from './regenerate.ts';