@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.5

package/src/cli/run/infra-deploy.run.cli-command.impl.ts

@@ -1,330 +0,0 @@
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import type { UIContext } from '@vibesdotdev/cli/providers';
-import { resolveCurrentEnvironmentConfig } from '@vibesdotdev/config/environment/current';
-import { resolve } from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { getCloudflareWorkersDeployClient } from '@vibesdotdev/connector-cloudflare/client';
-import { getDigitalOceanAppDeployClient } from '@vibesdotdev/infra-doks/client';
-import { loadDeploymentConfig } from '../../config-loader.ts';
-import { regenerateApp } from '../../regenerate.ts';
-
-function readString(v: unknown): string | undefined {
-	return typeof v === 'string' && v.length > 0 ? v : undefined;
-}
-function readBoolean(v: unknown): boolean {
-	return v === true || v === 'true';
-}
-
-function resolveWorkspaceRoot(
-	workspaceRootDir: string | undefined,
-	appDir: string,
-	override: string | undefined
-): string {
-	if (override) return resolve(override);
-	if (!workspaceRootDir || workspaceRootDir === '.') return process.cwd();
-	return resolve(appDir, workspaceRootDir);
-}
-
-const CLOUDFLARE_API_TOKEN_KEY = 'CLOUDFLARE_API_TOKEN';
-const CLOUDFLARE_ACCOUNT_ID_KEY = 'CLOUDFLARE_ACCOUNT_ID';
-
-async function resolveCloudflareEnvFromSecretsStore(
-	runtime: ReturnType<typeof getVibesRuntime>,
-	ui: UIContext,
-	environmentOverride?: string
-): Promise<Record<string, string>> {
-	if (process.env.CLOUDFLARE_API_TOKEN && process.env.CLOUDFLARE_ACCOUNT_ID) {
-		return {};
-	}
-	if (!runtime.hasKind('secrets/store')) {
-		throw new Error(
-			`Missing secrets/store kind in runtime. Enable secrets backends via plugin config ` +
-			`(for example plugins.auth.secrets=true and plugins.auth.secretsBackends.*) before running deploy.`
-		);
-	}
-
-	let envName = environmentOverride ?? 'local';
-	let envTier = 'local';
-	if (environmentOverride) {
-		envTier = environmentOverride;
-	} else {
-		try {
-			const envConfig = await resolveCurrentEnvironmentConfig();
-			envName = envConfig.name;
-			envTier = envConfig.tier ?? 'local';
-		} catch {
-			// Fall back to local when config environment resolution is unavailable.
-		}
-	}
-
-	const descriptors = runtime.assets('secrets/store').descriptors() as Array<{
-		id: string;
-		priority?: number;
-		tiers?: string[];
-	}>;
-	const tierCandidates = new Set([envTier]);
-	if (envTier === 'local' || envTier === 'dev') {
-		// Deploy auth is often run from local shells while credentials live in
-		// staging/production backends (Vault/Cloudflare). Include those tiers as
-		// fallbacks instead of hard-filtering them out.
-		tierCandidates.add('staging');
-		tierCandidates.add('production');
-	}
-	const candidates = descriptors
-		.filter((d) => {
-			if (environmentOverride) return true;
-			if (!d.tiers || d.tiers.length === 0) return true;
-			return d.tiers.some((tier) => tierCandidates.has(tier));
-		})
-		.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
-
-	const out: Record<string, string> = {};
-	for (const descriptor of candidates) {
-		const store = (await runtime
-			.query('secrets/store')
-			.withId(descriptor.id)
-			.resolve()) as {
-			get(environment: string, key: string): Promise<string | undefined>;
-		};
-
-		if (!process.env.CLOUDFLARE_API_TOKEN && !out.CLOUDFLARE_API_TOKEN) {
-			const value = await store.get(envName, CLOUDFLARE_API_TOKEN_KEY);
-			if (value && value.length > 0) {
-				out.CLOUDFLARE_API_TOKEN = value;
-			}
-		}
-
-		if (!process.env.CLOUDFLARE_ACCOUNT_ID && !out.CLOUDFLARE_ACCOUNT_ID) {
-			const value = await store.get(envName, CLOUDFLARE_ACCOUNT_ID_KEY);
-			if (value && value.length > 0) {
-				out.CLOUDFLARE_ACCOUNT_ID = value;
-			}
-		}
-
-		if (out.CLOUDFLARE_API_TOKEN && out.CLOUDFLARE_ACCOUNT_ID) break;
-	}
-
-	if (Object.keys(out).length > 0) {
-		ui.info(
-			`Resolved Cloudflare deploy credentials from secrets store (${envName}/${envTier}).`
-		);
-	}
-	return out;
-}
-
-export default {
-	async execute(args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
-		const runtime = getVibesRuntime();
-		const ui = (await runtime.context('cli/ui')) as UIContext;
-
-		const pathArg = readString(args.path) ?? process.cwd();
-		const output = readString(opts.output) ?? 'text';
-		const skipBuild = readBoolean(opts.skipBuild);
-		const skipD1Migrations = readBoolean(opts.skipD1Migrations);
-		const dryRun = readBoolean(opts.dryRun);
-		const workspaceRootOverride = readString(opts.workspaceRoot);
-		const targetEnvironment = readString(opts.environment);
-		let loaded;
-		try {
-			loaded = await loadDeploymentConfig(pathArg);
-		} catch (err) {
-			ui.error(`Failed to load deployment config: ${(err as Error).message}`);
-			process.exitCode = 1;
-			return;
-		}
-
-		const { deployment, provider, appDir } = loaded;
-		if (output === 'text') {
-			ui.info(`Deploying ${deployment.appName} (${deployment.appId}) via ${provider}`);
-		}
-
-		const onLine = (_stream: 'stdout' | 'stderr', line: string) => {
-			if (output === 'text') ui.log(line);
-		};
-
-		try {
-			switch (provider) {
-				case 'cloudflare-workers': {
-					const environment = readString(opts.wranglerEnv);
-					const workspaceRoot = resolveWorkspaceRoot(
-						deployment.build.workspaceRootDir,
-						appDir,
-						workspaceRootOverride
-					);
-
-					// Run generic pre-deploy commands (provider-agnostic hooks)
-					if (deployment.preDeployCommands.length > 0) {
-						onLine('stdout', `Running ${deployment.preDeployCommands.length} pre-deploy command(s)...`);
-						for (const cmd of deployment.preDeployCommands) {
-							if (cmd.description) {
-								onLine('stdout', `  ${cmd.description}`);
-							}
-							if (dryRun) {
-								onLine('stdout', `  [dry-run] ${cmd.command}`);
-								continue;
-							}
-							const [bin, ...args] = cmd.command.split(' ').filter(Boolean);
-							if (!bin) continue;
-							const child = spawnSync(bin, args, {
-								cwd: appDir,
-								stdio: 'inherit',
-								env: process.env
-							});
-							if (child.status !== 0) {
-								throw new Error(
-									`Pre-deploy command failed: ${cmd.command} (exit=${child.status ?? child.error?.message ?? 'unknown'})`
-								);
-							}
-						}
-						onLine('stdout', 'Pre-deploy commands complete.');
-					}
-
-					// Regen gate: refuse to deploy a stale wrangler.jsonc. For apps with
-					// `managed: true` in deployment.config.ts, this enforces that what's
-					// on disk matches what the typed config would produce. Unmanaged apps
-					// pass through (the gate is opt-in until every app is migrated).
-					const regen = await regenerateApp(appDir, { mode: 'check' });
-					if (regen.status === 'drift') {
-						const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-						const isKvIdDrift =
-							regen.diff &&
-							/^[\+\-]\s+"id":\s*"[^"]*"/m.test(regen.diff) &&
-							!uuidRe.test(regen.diff.replace(/"id":\s*"([^"]*)"/g, '$1').slice(0, 36));
-						if (!isKvIdDrift) {
-							const detail = regen.diff ? `\n${regen.diff}` : '';
-							throw new Error(
-								`wrangler.jsonc drift for ${regen.appId} — regenerate before deploy (run \`vibes infra deploy regenerate ${appDir}\`)${detail}`
-							);
-						}
-						onLine('stdout', `[regen] wrangler.jsonc verified (unchanged — kv namespace IDs resolved)`);
-					}
-					if (regen.status === 'error') {
-						throw new Error(
-							`regenerate check failed for ${appDir}: ${regen.reason ?? 'unknown error'}`
-						);
-					}
-					if (regen.status === 'updated' || regen.status === 'unchanged') {
-						onLine('stdout', `[regen] wrangler.jsonc verified (${regen.status})`);
-					} else if (regen.status === 'skipped') {
-						onLine('stdout', `[regen] skipped: ${regen.reason ?? 'not managed'}`);
-					}
-
-					const client = await getCloudflareWorkersDeployClient();
-					const envOverrides = await resolveCloudflareEnvFromSecretsStore(
-						runtime,
-						ui,
-						targetEnvironment
-					);
-
-					// Provisioning for KV, D1, R2 is now always attempted when declared
-					// (creation + ID reconciliation happens in the client using REST API).
-					// Migrations remain opt-in via autoMigrateD1 for safety.
-					const rawConfig = loaded.raw as Record<string, unknown>;
-					const autoMigrateD1 = rawConfig.autoMigrateD1 === true && !skipD1Migrations;
-					if (skipD1Migrations) {
-						onLine('stdout', 'Skipping D1 migrations for this deploy.');
-					}
-					const generatedWranglerConfig =
-						typeof rawConfig.generateWranglerConfig === 'function'
-							? (rawConfig.generateWranglerConfig() as Record<string, unknown>)
-							: loaded.wranglerJsoncString
-								? (JSON.parse(
-										loaded.wranglerJsoncString.replace(/^\s*\/\/.*$/gm, '')
-									) as Record<string, unknown>)
-								: rawConfig;
-
-					const d1Databases =
-						((rawConfig.d1Databases ??
-							rawConfig.d1_databases ??
-							generatedWranglerConfig.d1Databases ??
-							generatedWranglerConfig.d1_databases) as
-							| Array<{ binding: string; database_name: string; migrations_dir?: string }>
-							| undefined) ?? undefined;
-
-					const r2Buckets = (rawConfig.r2_buckets as
-						| Array<{ binding?: string; bucket_name: string }>
-						| undefined) ?? undefined;
-
-					const result = await client.deployWorker({
-						appDir,
-						workspaceRoot,
-						workerName: deployment.appId,
-						buildCommand: deployment.build.buildCommand,
-						skipBuild,
-						dryRun,
-						environment,
-						envOverrides,
-						kvNamespaces: (deployment as Record<string, unknown>).kvNamespaces as
-							| Array<{ binding: string; id: string; preview_id?: string }>
-							| undefined,
-						d1Databases: autoMigrateD1 ? d1Databases : undefined,
-						r2Buckets,
-						onLine
-					});
-
-					if (output === 'json') {
-						ui.json({
-							ok: true,
-							provider: 'cloudflare-workers',
-							workerName: result.workerName,
-							deployedUrl: result.deployedUrl
-						});
-					} else if (!dryRun) {
-						ui.success(
-							result.deployedUrl
-								? `Deployed Worker ${result.workerName} at ${result.deployedUrl}`
-								: `Deployed Worker ${result.workerName}`
-						);
-					}
-					return;
-				}
-				case 'digitalocean-app': {
-					const doAppId = readString(opts.doAppId);
-					const doRegion = readString(opts.doRegion);
-					const doGitRepo = readString(opts.doGitRepo);
-					const doGitBranch = readString(opts.doGitBranch);
-
-					const client = await getDigitalOceanAppDeployClient();
-					const result = await client.deployApp({
-						deployment,
-						appId: doAppId,
-						region: doRegion,
-						git: doGitRepo ? { repoCloneUrl: doGitRepo, branch: doGitBranch ?? 'main' } : undefined,
-						dryRun,
-						onLine
-					});
-
-					if (output === 'json') {
-						ui.json({
-							ok: true,
-							provider: 'digitalocean-app',
-							appId: result.appId,
-							liveUrl: result.liveUrl
-						});
-					} else if (!dryRun) {
-						ui.success(
-							result.liveUrl
-								? `Deployed DO App ${result.appId} at ${result.liveUrl}`
-								: `Deployed DO App ${result.appId}`
-						);
-					}
-					return;
-				}
-				default: {
-					ui.error(`Unsupported provider: ${provider}`);
-					ui.info('Supported providers: cloudflare-workers, digitalocean-app');
-					process.exitCode = 1;
-					return;
-				}
-			}
-		} catch (err) {
-			const message = (err as Error).message;
-			if (output === 'json') {
-				ui.json({ ok: false, error: message });
-			} else {
-				ui.error(message);
-			}
-			process.exitCode = 1;
-		}
-	}
-};

package/src/cli/shared/discover-deployments.ts

@@ -1,127 +0,0 @@
-/**
- * Discover deployed apps in a workspace by scanning for `deployment.config.ts`
- * files. Used by infra CLI commands that need the live inventory of deployed
- * workers/sites without hardcoding app names in framework packages.
- */
-
-import { readdir, stat } from 'node:fs/promises';
-import { join, isAbsolute, resolve } from 'node:path';
-import type { DeploymentDependency } from '@vibesdotdev/infra-core/deployment';
-import { loadDeploymentConfig } from '../../config-loader.ts';
-
-const CONFIG_NAMES = new Set([
-	'deployment.config.ts',
-	'deployment.config.js',
-	'deployment.config.mjs'
-]);
-
-const IGNORED_DIRS = new Set([
-	'node_modules',
-	'.git',
-	'.svelte-kit',
-	'dist',
-	'.next',
-	'.turbo',
-	'.vite',
-	'.wrangler'
-]);
-
-export interface DiscoveredDeployment {
-	appId: string;
-	appName: string;
-	provider: string;
-	appDir: string;
-	workerName: string | null;
-	dependsOn: DeploymentDependency[];
-}
-
-export interface DiscoverErrorInfo {
-	configPath: string;
-	appDir: string;
-	error: Error;
-}
-
-export interface DiscoverOptions {
-	/** Root to scan. Absolute, or relative to cwd. Defaults to cwd. */
-	root?: string;
-	/** Max directory depth. Defaults to 4. */
-	maxDepth?: number;
-	/** When set, only return deployments whose provider matches. */
-	provider?: string;
-	/**
-	 * Invoked once per config that fails to load. The default behavior is to
-	 * silently skip — `vibes infra deploy list` overrides this to surface
-	 * unparseable rows.
-	 */
-	onError?: (info: DiscoverErrorInfo) => void;
-}
-
-async function findConfigs(root: string, maxDepth: number): Promise<string[]> {
-	const found: string[] = [];
-	async function walk(dir: string, depth: number): Promise<void> {
-		if (depth > maxDepth) return;
-		let entries: string[];
-		try {
-			entries = await readdir(dir);
-		} catch {
-			return;
-		}
-		for (const entry of entries) {
-			if (CONFIG_NAMES.has(entry)) found.push(join(dir, entry));
-		}
-		for (const entry of entries) {
-			if (IGNORED_DIRS.has(entry) || entry.startsWith('.')) continue;
-			const full = join(dir, entry);
-			let info;
-			try {
-				info = await stat(full);
-			} catch {
-				continue;
-			}
-			if (info.isDirectory()) await walk(full, depth + 1);
-		}
-	}
-	await walk(root, 0);
-	return found;
-}
-
-/**
- * Scan `root` for every `deployment.config.ts` and return the loaded
- * deployment descriptors. Configs that fail to load are skipped; pass
- * `onError` to be notified about each failure (e.g. to render
- * `(unparseable)` rows in the list command).
- */
-export async function discoverDeployments(
-	opts: DiscoverOptions = {}
-): Promise<DiscoveredDeployment[]> {
-	const rootInput = opts.root ?? process.cwd();
-	const root = isAbsolute(rootInput) ? rootInput : resolve(process.cwd(), rootInput);
-	const maxDepth = opts.maxDepth ?? 4;
-
-	const configPaths = await findConfigs(root, maxDepth);
-	const results: DiscoveredDeployment[] = [];
-
-	for (const configPath of configPaths) {
-		const appDir = configPath.replace(/\/deployment\.config\.(ts|js|mjs)$/, '');
-		try {
-			const loaded = await loadDeploymentConfig(appDir);
-			if (opts.provider && loaded.provider !== opts.provider) continue;
-			results.push({
-				appId: loaded.deployment.appId,
-				appName: loaded.deployment.appName,
-				provider: loaded.provider,
-				appDir: loaded.appDir,
-				workerName: loaded.workerName,
-				dependsOn: loaded.deployment.dependsOn ?? []
-			});
-		} catch (err) {
-			opts.onError?.({
-				configPath,
-				appDir,
-				error: err instanceof Error ? err : new Error(String(err))
-			});
-		}
-	}
-
-	return results;
-}

package/src/config-loader.ts

@@ -1,179 +0,0 @@
-import { resolve, isAbsolute, join, dirname } from 'node:path';
-import { existsSync, statSync } from 'node:fs';
-import { spawn } from 'node:child_process';
-import type { AppDeployment } from '@vibesdotdev/infra-core/deployment';
-
-export interface LoadedDeployment {
-	configPath: string;
-	appDir: string;
-	deployment: AppDeployment;
-	provider: string;
-	raw: unknown;
-	/**
-	 * Canonical wrangler.jsonc render output, when the default export is a
-	 * managed Cloudflare web-app deployment (see
-	 * `@vibesdotdev/infra-cloudflare/regen`). `null` when the export isn't
-	 * a managed deployment — used by the regen orchestrator to gate writes
-	 * and the CI drift check.
-	 */
-	wranglerJsoncString: string | null;
-	/** Mirrors `webAppDeployment.managed`; `false` when not a managed export. */
-	managed: boolean;
-	/** Cloudflare Workers script name, when emitted by the managed export. */
-	workerName: string | null;
-}
-
-const CONFIG_FILENAMES = ['deployment.config.ts', 'deployment.config.js', 'deployment.config.mjs'];
-
-export function resolveAppDir(input: string): string {
-	const absolute = isAbsolute(input) ? input : resolve(process.cwd(), input);
-	if (!existsSync(absolute)) {
-		throw new Error(`Path does not exist: ${absolute}`);
-	}
-	const stat = statSync(absolute);
-	if (!stat.isDirectory()) {
-		throw new Error(`Expected directory, got file: ${absolute}`);
-	}
-	return absolute;
-}
-
-export function findConfigFile(appDir: string): string {
-	for (const name of CONFIG_FILENAMES) {
-		const candidate = join(appDir, name);
-		if (existsSync(candidate)) return candidate;
-	}
-	throw new Error(
-		`No deployment config found in ${appDir}. Expected one of: ${CONFIG_FILENAMES.join(', ')}`
-	);
-}
-
-function extractDeployment(raw: unknown): { deployment: AppDeployment; provider: string } {
-	if (!raw || typeof raw !== 'object') {
-		throw new Error('deployment.config default export must be an object');
-	}
-	const record = raw as Record<string, unknown>;
-	const deployment = (record.deployment ?? record) as AppDeployment | undefined;
-	if (!deployment || typeof deployment !== 'object' || !('appId' in deployment)) {
-		throw new Error('deployment.config must export an AppDeployment (or { deployment })');
-	}
-	const provider = (deployment as AppDeployment).provider;
-	if (!provider || typeof provider !== 'string') {
-		throw new Error('deployment.provider is required');
-	}
-	return { deployment: deployment as AppDeployment, provider };
-}
-
-/**
- * Walk upward from `from` looking for the workspace root (the directory
- * with a `bun.lock` or `package.json` containing `workspaces`).
- */
-function findWorkspaceRoot(from: string): string {
-	let dir = from;
-	while (dir !== dirname(dir)) {
-		if (existsSync(join(dir, 'bun.lock'))) return dir;
-		const pkgPath = join(dir, 'package.json');
-		if (existsSync(pkgPath)) {
-			try {
-				const pkg = JSON.parse(require('node:fs').readFileSync(pkgPath, 'utf8'));
-				if (pkg.workspaces) return dir;
-			} catch {
-				// not a parseable package.json; keep walking
-			}
-		}
-		dir = dirname(dir);
-	}
-	return from;
-}
-
-interface SubprocessOutput {
-	raw: unknown;
-	render: {
-		managed: boolean;
-		rendered: string | null;
-		workerName: string | null;
-	};
-}
-
-/**
- * Load a deployment.config.ts via a `bun` subprocess from the workspace
- * root. Direct `await import(configPath)` doesn't work when the compiled
- * `vibes` binary runs against a workspace symlink — its bundled module
- * resolver has no idea where `@vibesdotdev/infra-core` lives. Subprocess
- * inherits the workspace's bun (path + node_modules), so workspace
- * package imports resolve as if you ran `bun apps/<app>/deployment.config.ts`
- * directly.
- *
- * The subprocess also tries to import `@vibesdotdev/infra-cloudflare/web-app`
- * and call `renderWranglerJsoncFromDefaultExport(raw)` so the canonical
- * wrangler.jsonc string is returned alongside the raw config. This lets
- * the regen orchestrator stay agnostic of provider-specific rendering.
- * If the import fails (SDK consumer without infra-cloudflare in their
- * tree), the render block is reported as `{ managed: false, rendered: null }`.
- */
-async function loadConfigViaSubprocess(
-	configPath: string,
-	workspaceRoot: string
-): Promise<SubprocessOutput> {
-	return new Promise((resolvePromise, reject) => {
-		const script = `
-			const mod = await import(${JSON.stringify(configPath)});
-			const raw = mod.default ?? mod;
-			let render = { managed: false, rendered: null, workerName: null };
-			try {
-				const cf = await import('@vibesdotdev/infra-cloudflare/web-app');
-				if (typeof cf.renderWranglerJsoncFromDefaultExport === 'function') {
-					render = cf.renderWranglerJsoncFromDefaultExport(raw);
-				}
-			} catch (_) {
-				// infra-cloudflare not resolvable; leave render as the default null block.
-			}
-			process.stdout.write(JSON.stringify({ raw, render }));
-		`;
-		const child = spawn('bun', ['--bun', '-e', script], {
-			cwd: workspaceRoot,
-			stdio: ['ignore', 'pipe', 'pipe']
-		});
-		let stdout = '';
-		let stderr = '';
-		child.stdout?.on('data', (chunk) => (stdout += String(chunk)));
-		child.stderr?.on('data', (chunk) => (stderr += String(chunk)));
-		child.on('error', reject);
-		child.on('close', (code) => {
-			if (code !== 0) {
-				reject(
-					new Error(
-						`bun subprocess exited with code ${code}\nstderr: ${stderr.trim()}\nstdout: ${stdout.trim()}`
-					)
-				);
-				return;
-			}
-			try {
-				resolvePromise(JSON.parse(stdout) as SubprocessOutput);
-			} catch (err) {
-				reject(
-					new Error(
-						`Failed to parse subprocess JSON output: ${err instanceof Error ? err.message : String(err)}\nstdout: ${stdout.slice(0, 500)}`
-					)
-				);
-			}
-		});
-	});
-}
-
-export async function loadDeploymentConfig(appDir: string): Promise<LoadedDeployment> {
-	const dir = resolveAppDir(appDir);
-	const configPath = findConfigFile(dir);
-	const workspaceRoot = findWorkspaceRoot(dir);
-	const output = await loadConfigViaSubprocess(configPath, workspaceRoot);
-	const { deployment, provider } = extractDeployment(output.raw);
-	return {
-		configPath,
-		appDir: dir,
-		deployment,
-		provider,
-		raw: output.raw,
-		wranglerJsoncString: output.render.rendered,
-		managed: output.render.managed,
-		workerName: output.render.workerName
-	};
-}

package/src/index.ts

@@ -1,11 +0,0 @@
-export { default as infraDeployPlugin } from './infra-deploy.plugin';
-export { loadDeploymentConfig } from './config-loader.ts';
-export type { LoadedDeployment } from './config-loader.ts';
-export {
-	regenerateApp,
-	regenerateAll,
-	regenExitCode,
-	type RegenResult,
-	type RegenStatus,
-	type RegenerateOptions
-} from './regenerate.ts';