@vibesdotdev/infra-doks 0.0.1

package/README.md

@@ -0,0 +1,107 @@
+# @vibesdotdev/infra-doks
+
+DigitalOcean / DOKS adapter for Vibes runtime kinds. Supplies the
+DigitalOcean / DOKS-flavored descriptor + implementation pairs the
+runtime selects when scope resolves to a DO/cluster target.
+
+The contract lives in [SPEC.md](./SPEC.md). This README is usage notes.
+
+## Install
+
+```sh
+bun add @vibesdotdev/infra-doks
+```
+
+Workspace-internal — declared as `"@vibesdotdev/infra-doks": "workspace:*"`.
+
+## Plugin
+
+```ts
+import doksPlugin from '@vibesdotdev/infra-doks/plugin';
+import { createRuntime } from '@vibesdotdev/runtime';
+import infraPlugin from '@vibesdotdev/infra-core/plugin';
+
+const runtime = createRuntime();
+await runtime.use(infraPlugin);
+await runtime.use(doksPlugin);
+```
+
+`doksPlugin` depends on the `infra` plugin from `infra-core`. Activate
+`infra-core` first so the kinds are registered before `doksPlugin` adds
+its loaders.
+
+## What's wired today
+
+Only the `secrets/store` Vault pair. After bootstrap, the runtime can
+resolve a HashiCorp Vault-backed `secrets/store` for environments
+running inside a Kubernetes cluster:
+
+```ts
+import { getVibesSecretsClient } from '@vibesdotdev/secrets/runtime/client';
+
+const secrets = await getVibesSecretsClient();
+const dbPassword = await secrets.get('staging', 'POSTGRES_PASSWORD');
+```
+
+The Vault descriptor is `hardware: ['cloud']` only. It will not match on
+consumer hardware. Auth uses (in order) descriptor `token`, the
+`VAULT_TOKEN` env var, then exchanges the in-pod K8s service-account JWT
+at `/var/run/secrets/kubernetes.io/serviceaccount/token` for a Vault
+token via `/v1/auth/kubernetes/login`. All three failing throws.
+
+Vault KV path layout matches the deployment Helm chart's secret groups:
+`{mount}/app`, `{mount}/oauth`, `{mount}/artifacts`,
+`{mount}/infrastructure`. New keys default to the `app` group.
+
+## What's not wired (migration debt)
+
+The K8s and DO managed-service generators are exported but not
+registered against `infra/*` kinds yet. They are usable as standalone
+functions, but consuming them this way bypasses the runtime selection
+flow:
+
+```ts
+import { generateK8sDeployment } from '@vibesdotdev/infra-doks';
+
+const manifest = generateK8sDeployment(workerDescriptor);
+```
+
+See [SPEC.md](./SPEC.md) → **Migration debt** for the path to wiring
+these as descriptor + impl pairs (mirroring the
+[`infra-cloudflare`](../infra-cloudflare) plugin layout).
+
+## Vault tier mapping
+
+The descriptor's `config.mount` is the default. At resolution time the
+impl picks a mount per environment:
+
+| `environment` | Vault mount         |
+| ------------- | ------------------- |
+| `staging`     | `staging`           |
+| `production`  | `production`        |
+| anything else | `config.mount` (default `staging`) |
+
+Override the default address or mount via the descriptor's `config`
+record (string-valued, per the `secrets/store` schema).
+
+## Tests
+
+```sh
+bun test packages/infra-doks
+```
+
+Covers plugin shape and deterministic generator output. No live Vault,
+Kubernetes, or DigitalOcean API access is exercised.
+
+Type gate:
+
+```sh
+bun --bun tsc -p packages/infra-doks/tsconfig.json --noEmit
+```
+
+## Related
+
+- [`infra-core`](../infra-core) — kinds and base schemas.
+- [`infra-cloudflare`](../infra-cloudflare) — sibling Cloudflare adapter.
+- [`secrets`](../secrets) — `secrets/store` kind, interface, default impl.
+- [`deploy`](../deploy) — orchestration that consumes the manifests.

package/SPEC.md

@@ -0,0 +1,285 @@
+# @vibesdotdev/infra-doks
+
+DigitalOcean / DOKS adapter for runtime kinds defined elsewhere: `infra/*`
+from [`infra-core`](../infra-core/SPEC.md) and `secrets/store` from
+[`secrets`](../secrets/SPEC.md). Each kind defines a base descriptor
+schema, an implementation interface, and a pass-through default impl in
+its owning package; this package supplies the DigitalOcean / DOKS
+**descriptor + impl** pair the runtime selects when scope resolves to a
+DO/cluster target. The canonical adapter pattern lives in
+[`infra-cloudflare`](../infra-cloudflare/SPEC.md) — same plugin shape,
+same `createRuntimeImplementation` bridge, same per-impl descriptor
+schemas alongside the generators. Every adapter pair owned here is REGISTERED with the runtime via
+`runtime.registerLoader` in `onActivate` (`vault`, `doks-deployment`,
+`doks-statefulset` for queue and database, `do-managed-postgres`,
+`do-managed-redis`, `do-spaces`, `gitea-doks`, `verdaccio-doks`, plus the
+`digitalocean-droplet` sandbox). Whether each registration is reached by
+an in-repo consumer is a separate question — see "Consumers" below.
+Today the registered set splits roughly in half: `vault`,
+`digitalocean-droplet`, `gitea-doks`, and `verdaccio-doks` have live
+consumers; the rest are registered-only (and `infra/generate.ts` even
+inlines a parallel shape for `doks-deployment` and `do-spaces` that
+drifts from this package's generator).
+
+## Owns
+
+- **Plugin descriptor:** `doksPlugin` (id `infra-doks`, depends on `infra`).
+  In `onActivate`, lazy-registers each pair via `runtime.registerLoader`.
+  Implementations are `await import()`-ed inside the loader, never at
+  module load.
+- **`secrets/store` `vault` descriptor + impl** (`./secrets`). Descriptor in `vault.descriptor.ts`
+  (`backend: 'vault'`, `hardware: ['cloud']`,
+  `tiers: ['staging', 'production']`, default address
+  `http://vault.observability.svc.cluster.local:8200`, K8s auth method).
+  Impl in `vault.impl.ts` is a `SecretsStoreImplementation` walking the
+  fixed Vault KV v2 path groups `app`/`oauth`/`artifacts`/
+  `infrastructure`, defaulting new keys to `app`. HTTP client in
+  `vault.client.ts` (K8s service-account token exchange against
+  `/v1/auth/kubernetes/login`). Priority 30. `createVaultStore` wraps
+  the store in `createRuntimeImplementation`.
+- **`infra/worker` `doks-deployment` descriptor + impl** (`./implementations/deployment`).
+  Adapter descriptor schema `DoksDeploymentDescriptorSchema` co-located with
+  `generateK8sDeployment` generator. Implementation produces a K8s
+  Deployment manifest. Priority 20.
+- **`infra/queue` `doks-statefulset` descriptor + impl** (`./implementations/statefulset`).
+  Adapter descriptor schema `DoksQueueDescriptorSchema` co-located with
+  `generateK8sStatefulSet` generator for Kafka/Redpanda. Implementation
+  produces a K8s StatefulSet manifest. Priority 20.
+- **`infra/database` `doks-statefulset` descriptor + impl** (`./implementations/statefulset`).
+  Adapter descriptor schema `DoksDatabaseDescriptorSchema` co-located with
+  `generateK8sStatefulSet` generator for self-hosted Postgres. Implementation
+  produces a K8s StatefulSet manifest. Priority 20.
+- **`infra/database` `do-managed-postgres` descriptor + impl** (`./implementations/managed-db`).
+  Adapter descriptor schema `DOManagedPostgresDescriptorSchema` co-located with
+  `generateDOManagedDB` generator. Implementation produces a DO Managed Database
+  API spec. Priority 30 (higher than StatefulSet so managed is preferred when adapter
+  matches).
+- **`infra/cache` `do-managed-redis` descriptor + impl** (`./implementations/managed-redis`).
+  Adapter descriptor schema `DOManagedRedisDescriptorSchema` co-located with
+  `generateDOManagedRedis` generator. Implementation produces a DO Managed Redis
+  API spec. Priority 20.
+- **`infra/object-storage` `do-spaces` descriptor + impl** (`./implementations/spaces`).
+  Adapter descriptor schema `DOSpacesDescriptorSchema` co-located with
+  `generateDOSpaces` generator. Implementation produces a DO Spaces API spec.
+  Priority 20.
+- **`infra/git-hosting` `gitea-doks` descriptor + impl** (`./implementations/gitea.impl`).
+  Adapter descriptor schema `GiteaDoksDescriptorSchema` co-located with
+  `generateGiteaManifest` generator. Implementation produces K8s
+  Deployment + Service + PersistentVolumeClaim + Ingress manifests for Gitea.
+  Priority 20.
+- **`infra/package-registry` `verdaccio-doks` descriptor + impl** (`./implementations/verdaccio.impl`).
+  Adapter descriptor schema `VerdaccioDoksDescriptorSchema` co-located with
+  `generateVerdaccioManifest` generator. Implementation produces K8s
+  Deployment + Service + PersistentVolumeClaim + ConfigMap + Ingress manifests
+  for Verdaccio. Priority 20.
+- **`infra/sandbox` `digitalocean-droplet` descriptor + impl**
+  (`./implementations/droplet`). Implements the `digitalocean-droplet`
+  variant of `infra/sandbox` whose schema already lives in
+  [`infra-core`](../infra-core/SPEC.md). Wires the existing
+  `DigitalOceanProvider` (`./cloud/digitalocean.ts`) into the runtime
+  kind resolution path: creates the droplet via DO `/v2/droplets`,
+  waits for `status: 'active'`, returns
+  `{ instanceId, publicIp, privateIp, region, createdAt }`. Optional
+  `cloudInitScript` is forwarded as `user_data`. Priority 20.
+- **Manifest output types** (`./types`): K8s API subset (`K8sDeployment`,
+  `K8sStatefulSet`, `K8sService`, `K8sConfigMap`, `K8sSecret`,
+  `K8sContainer`, `K8sPodSpec`, `K8sPodTemplateSpec`, `K8sProbe`,
+  `K8sResourceRequirements`, `K8sLabelSelector`, `K8sVolumeClaimTemplate`)
+  and DO managed-service spec shapes (`DOManagedDBSpec`,
+  `DOManagedRedisSpec`, `DOSpacesSpec`).
+- **Manifest generator functions** (`./implementations`): pure functions
+  `generateK8sDeployment`, `generateK8sStatefulSet`,
+  `generateDOManagedDB`, `generateDOManagedRedis`, `generateDOSpaces`,
+  `generateGiteaManifest`, `generateVerdaccioManifest`.
+  Each takes an adapter-specific descriptor and returns a manifest object,
+  namespace `vibes`, name `vibes-{descriptor.id}`.
+- **`runtime/client` `digitalocean-app-deploy` descriptor + impl**
+  (`./client`). `DigitalOceanAppDeployClient extends BaseRuntimeClient`
+  exposes `deployApp(options): Promise<DeployAppResult>` — translates an
+  `AppDeployment` to a DO App spec and POSTs `/apps` (create) or PUTs
+  `/apps/{id}` (update) via the v2 REST API. Consumed by
+  [`infra-deploy`](../infra-deploy/SPEC.md)'s CLI run handler through the
+  published `getDigitalOceanAppDeployClient()` helper. Reads
+  `DIGITALOCEAN_API_TOKEN` from the operator's env (secrets-manager
+  brokerage tracked in `infra-deploy/SPEC.md` migration debt).
+
+## Does not own
+
+- Infra runtime kinds and their base descriptor schemas →
+  [`infra-core`](../infra-core/SPEC.md).
+- `secrets/store` kind, `SecretsStoreImplementation` interface, default
+  in-process impl, and env-requirement resolution →
+  [`secrets`](../secrets/SPEC.md).
+- Cloudflare descriptor + impl pairs (Workers / Queues / R2 / KV /
+  cloudflare-api `secrets/store`) →
+  [`infra-cloudflare`](../infra-cloudflare/SPEC.md).
+- `kubectl apply`, deployment orchestration, env materialization, and the
+  `infra/` workspace tree → [`infra-deploy`](../infra-deploy/SPEC.md).
+- DigitalOcean API clients that actually create Managed DB / Redis /
+  Spaces resources. Generators here produce request-shaped specs only;
+  the only DO API client surface in this package is the
+  `DigitalOceanAppDeployClient` (App Platform deploys) and the existing
+  `DigitalOceanProvider` (droplets, volumes, VPCs) — both behind the
+  runtime kind resolution path, not via direct import.
+
+## Hard rules
+
+- The plugin registers every implementation through
+  `runtime.registerLoader` in `onActivate`. Do not import
+  implementations at module load — Vault auth touches Node FS and the
+  network and must not run on `import`.
+- Adapter packages provide descriptor + impl pairs for kinds defined
+  elsewhere. Defining a new kind here is a layering violation — add it
+  to its owning package (`infra-core`, `secrets`, …) first.
+- The descriptor + impl unit follows infra-cloudflare's shape: each
+  `*.impl.ts` co-locates the adapter descriptor schema (extending the
+  base kind with adapter-specific fields), the generator, and the output
+  type; the plugin file holds the `create*Impl(input)` factory that
+  parses the descriptor and wraps the generator in
+  `createRuntimeImplementation`; `onActivate` calls `registerLoader` for
+  each pair. Do not split these layers across additional files.
+- Each kind's implementation interface is defined in its owning package.
+  `secrets/store` requires the full `SecretsStoreImplementation` CRUD
+  interface; `infra/*` kinds expect `{ generateConfig: () => …Manifest }`
+  per the cloudflare precedent. Adapters fulfill the kind's interface
+  exactly; do not invent a parallel interface.
+- Vault auth precedence: descriptor `token`, then `VAULT_TOKEN` env,
+  then exchange the K8s service-account JWT at
+  `/var/run/secrets/kubernetes.io/serviceaccount/token` for a Vault
+  token. Failing all three throws — never silently fall through.
+- The `digitalocean-droplet` impl is the only path through which
+  `DigitalOceanProvider` (`./cloud/digitalocean.ts`) is reachable from
+  the runtime. Direct imports of `./cloud/digitalocean.ts` from
+  feature packages are layering violations; that class moves from
+  orphan to runtime-bound on this landing.
+- Droplet creation is idempotent against the descriptor `id`: a second
+  call with the same id returns the existing droplet rather than
+  creating a duplicate. Tag droplets with `vibes:resourceId=<id>` to
+  make the lookup cheap.
+- DO API token resolution: descriptor override →
+  `DIGITALOCEAN_API_TOKEN` env → `packages/secrets`
+  `cloud-credentials.digitalocean.token` once brokerage lands. Same
+  precedence the rest of this package uses.
+- The Vault descriptor is `hardware: ['cloud']` only. It must not
+  register on consumer hardware; the in-cluster Vault address is
+  unreachable elsewhere.
+- Manifest generators are pure: descriptor in, plain object out, no
+  I/O, no side effects. Probes, resource requests/limits, namespace
+  `vibes`, and the `vibes-{descriptor.id}` naming convention are part
+  of the contract — change them only with a deploy-side coordinated
+  update.
+- Vault KV path groups (`app`, `oauth`, `artifacts`, `infrastructure`)
+  match the deployment Helm chart's secret groups. Adding a new group
+  requires updating this list and the chart in lockstep.
+- Manifest generators are config transforms and stay pure; the only
+  runtime-bound clients that perform I/O are the `runtime/client`
+  `digitalocean-app-deploy` (App Platform deploys) and the existing
+  `digitalocean-droplet` `infra/sandbox` impl (droplets). Adding another
+  cloud-API surface means adding a new `runtime/client` or kind impl —
+  never a top-level export bypassing the runtime.
+- The `digitalocean-app-deploy` client reads `DIGITALOCEAN_API_TOKEN`
+  from process env today (matches the `digitalocean-droplet` impl
+  precedence). End-state: resolve `cloud-credentials.digitalocean.token`
+  via `packages/secrets` per actor scope.
+
+## Consumers
+
+Status of each impl pair's consumption path:
+
+- **`secrets/store` → `vault`**: consumed by `infra/vault-setup.ts` via Vault HTTP
+  client; production-wired.
+- **`infra/sandbox` → `digitalocean-droplet`**: consumed by
+  `packages/runner-adapter-digitalocean` (GPU on-demand inference). Required at
+  runtime — removing this loader breaks GPU runner activation.
+- **`runtime/client` → `digitalocean-app-deploy`**: consumed by
+  [`infra-deploy`](../infra-deploy/SPEC.md) via
+  `getDigitalOceanAppDeployClient()` in
+  `packages/infra-deploy/src/cli/run/infra-deploy.run.cli-command.impl.ts`.
+  Required for `vibes infra deploy run` against DO App Platform apps.
+- **`infra/git-hosting` → `gitea-doks`** and
+  **`infra/package-registry` → `verdaccio-doks`**: consumed by `infra/generate.ts`
+  via direct `generateGiteaManifest` / `generateVerdaccioManifest` imports
+  (not via the runtime resolver). Active in DOKS apply phase.
+- **`infra/worker` → `doks-deployment`**, **`infra/queue` → `doks-statefulset`**,
+  **`infra/database` → `doks-statefulset` / `do-managed-postgres`**,
+  **`infra/cache` → `do-managed-redis`**, **`infra/object-storage` → `do-spaces`**:
+  registered with the runtime but no in-repo consumer resolves them yet.
+  `infra/generate.ts` inlines its own K8s Deployment YAML for the
+  `doks-deployment` workers (`ai-workers`, `crawl-workers`, `workbench-workers`)
+  with a DIFFERENT shape than `generateK8sDeployment` (different image prefix
+  `ghcr.io/vibes-dev` vs. `vibes/`, inline `env[]` vs. `envFrom: configMapRef`,
+  includes `HorizontalPodAutoscaler`). The infra-doks generator is the
+  canonical target shape; `infra/generate.ts` is the current production shape.
+  Consolidation needs a deploy-side coordinated test pass (apply against a
+  DOKS cluster, diff manifests) — tracked as migration debt below.
+
+## Migration debt
+
+- [ ] **`infra/generate.ts` doks-deployment / do-spaces inlining drift.**
+  `infra/generate.ts` inlines K8s Deployment + HPA YAML and DO Spaces JSON
+  rather than routing through `generateK8sDeployment` / `generateDOSpaces`.
+  Reconciling requires aligning the infra-doks generators with the inline
+  shapes (add HPA support, default image prefix `ghcr.io/vibes-dev`, allow
+  inline env + secret env) and running an apply-dry-run diff against the
+  current `infra/generated/k8s-*-workers.yaml` files before flipping over.
+
+- [ ] **`infra/git-hosting` and `infra/package-registry` impl pairs are new.**
+  `gitea.impl.ts` and `verdaccio.impl.ts` register `gitea-doks` and `verdaccio-doks`
+  loaders for the new kinds. Both implementations follow the existing impl pattern.
+  Full validation: `createRuntimeAsset` calls must validate `config` against the
+  kind's registered `descriptorSchema` once the runtime `config` field migration
+  in `runtime` is complete.
+
+- [x] **Five DOKS/DO descriptor + impl pairs are unbuilt.** The generators
+  exist, but each impl file was missing its adapter descriptor schema,
+  the plugin was missing its `create*Impl(input)` factory, and
+  `onActivate` was missing the matching `registerLoader` call.
+  **Resolution:** Mirrored `infra-cloudflare` exactly:
+  - `infra/worker` ← `generateK8sDeployment` via `doks-deployment` loader (priority 20)
+  - `infra/queue` ← `generateK8sStatefulSet` via `doks-statefulset` loader (priority 20)
+  - `infra/database` ← `generateK8sStatefulSet` via `doks-statefulset` loader (priority 20)
+    and `generateDOManagedDB` via `do-managed-postgres` loader (priority 30)
+  - `infra/cache` ← `generateDOManagedRedis` via `do-managed-redis` loader (priority 20)
+  - `infra/object-storage` ← `generateDOSpaces` via `do-spaces` loader (priority 20)
+  Each implementation follows the `{ generateConfig: () => Manifest }` shape
+  per the cloudflare precedent.
+- [x] **`package.json#exports` wildcard cleanup.**
+  **Resolution:** Replaced `"./implementations/*": "./src/implementations/*"` with
+  explicit per-impl subpaths:
+  - `./implementations/deployment`
+  - `./implementations/statefulset`
+  - `./implementations/managed-db`
+  - `./implementations/managed-redis`
+  - `./implementations/spaces`
+  Grep found no in-repo consumer of the wildcard.
+- [x] **`infra-core`'s `deploymentProviderSchema` enum coordination.**
+  **Resolution:** This is already cross-recorded in [`infra-core`](../infra-core/SPEC.md)
+  migration debt. The `infra-doks` package provides the implementations; the enum
+  trim in `infra-core` is a separate action item tracked there.
+
+## Public entrypoints
+
+`.`, `./plugin`, `./implementations/deployment`, `./implementations/statefulset`,
+`./implementations/managed-db`, `./implementations/managed-redis`,
+`./implementations/spaces`, `./implementations/gitea`, `./implementations/verdaccio`,
+`./secrets`, `./cloud`, `./kubernetes`, `./types`, `./client`.
+
+Wildcard / migration-era subpaths: None — the explicit per-impl subpaths above
+replace the former `./implementations/*` wildcard.
+
+## Verification
+
+`bun test` from `packages/infra-doks`. Covers plugin shape (`id`,
+`dependencies`, `name`) and deterministic-output tests for each of
+`deployment.impl`, `statefulset.impl`, `managed-db.impl`,
+`managed-redis.impl`, `spaces.impl`. No live Vault, Kubernetes API, or
+DigitalOcean API contact is exercised; those are deploy-time gates.
+Type gate is `bun --bun tsc -p tsconfig.json --noEmit`.
+
+## Links
+
+- [infra-core/SPEC.md](../infra-core/SPEC.md)
+- [infra-cloudflare/SPEC.md](../infra-cloudflare/SPEC.md)
+- [secrets/SPEC.md](../secrets/SPEC.md)
+- [runtime/SPEC.md](../runtime/SPEC.md)
+- [infra-deploy/SPEC.md](../infra-deploy/SPEC.md)

package/dist/client/digitalocean-app-deploy.client.d.ts

@@ -0,0 +1,46 @@
+/**
+ * DigitalOcean App Platform Deploy Client
+ *
+ * Canonical `runtime/client` (id `digitalocean-app-deploy`) for creating or
+ * updating an App Platform application from an `AppDeployment` manifest.
+ * Uses the DigitalOcean REST API v2 directly (no `doctl` dependency).
+ *
+ * Consumers resolve via `getDigitalOceanAppDeployClient()` (preferred)
+ * or `getVibesClient<DigitalOceanAppDeployClient>('digitalocean-app-deploy')`.
+ *
+ * For the initial deploy, the DO App needs a source reference. The common case
+ * is a git repo reference — the CLI writes the app spec; the operator connects
+ * the git repo in the DO dashboard once. Subsequent calls update the spec.
+ *
+ * Credentials: reads `DIGITALOCEAN_API_TOKEN` from the operator's environment.
+ * (Secrets-manager integration is tracked in `infra-deploy/SPEC.md` Migration
+ * debt — once landed, this client will resolve the token via secrets/store.)
+ */
+import type { VibesRuntime } from '@vibesdotdev/runtime';
+import { BaseRuntimeClient, type RuntimeClientDescriptor } from '@vibesdotdev/runtime-client';
+import type { AppDeployment } from '@vibesdotdev/infra-core/deployment';
+export interface DeployAppOptions {
+    deployment: AppDeployment;
+    /** Existing DO App id (for updates). Omit to create a new App. */
+    appId?: string;
+    /** Region slug, e.g. 'nyc', 'sfo3', 'ams'. */
+    region?: string;
+    /** Git repo reference for the app source (github/gitlab). */
+    git?: {
+        repoCloneUrl?: string;
+        branch?: string;
+    };
+    /** Environment name for DO (e.g. 'production'). */
+    environmentName?: string;
+    dryRun?: boolean;
+    onLine?: (stream: 'stdout' | 'stderr', line: string) => void;
+}
+export interface DeployAppResult {
+    appId: string;
+    liveUrl?: string;
+}
+export declare class DigitalOceanAppDeployClient extends BaseRuntimeClient {
+    constructor(descriptor?: RuntimeClientDescriptor, context?: unknown, runtime?: VibesRuntime);
+    deployApp(options: DeployAppOptions): Promise<DeployAppResult>;
+}
+//# sourceMappingURL=digitalocean-app-deploy.client.d.ts.map

package/dist/client/digitalocean-app-deploy.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digitalocean-app-deploy.client.d.ts","sourceRoot":"","sources":["../../src/client/digitalocean-app-deploy.client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACN,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAIxE,MAAM,WAAW,gBAAgB;IAChC,UAAU,EAAE,aAAa,CAAC;IAC1B,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,GAAG,CAAC,EAAE;QACL,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAiID,qBAAa,2BAA4B,SAAQ,iBAAiB;gBAEhE,UAAU,GAAE,uBAGX,EACD,OAAO,CAAC,EAAE,OAAO,EACjB,OAAO,CAAC,EAAE,YAAY;IAKjB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;CAmCpE"}

package/dist/client/digitalocean-app-deploy.client.js

@@ -0,0 +1,135 @@
+/**
+ * DigitalOcean App Platform Deploy Client
+ *
+ * Canonical `runtime/client` (id `digitalocean-app-deploy`) for creating or
+ * updating an App Platform application from an `AppDeployment` manifest.
+ * Uses the DigitalOcean REST API v2 directly (no `doctl` dependency).
+ *
+ * Consumers resolve via `getDigitalOceanAppDeployClient()` (preferred)
+ * or `getVibesClient<DigitalOceanAppDeployClient>('digitalocean-app-deploy')`.
+ *
+ * For the initial deploy, the DO App needs a source reference. The common case
+ * is a git repo reference — the CLI writes the app spec; the operator connects
+ * the git repo in the DO dashboard once. Subsequent calls update the spec.
+ *
+ * Credentials: reads `DIGITALOCEAN_API_TOKEN` from the operator's environment.
+ * (Secrets-manager integration is tracked in `infra-deploy/SPEC.md` Migration
+ * debt — once landed, this client will resolve the token via secrets/store.)
+ */
+import { getRuntimeEnv } from '@vibesdotdev/runtime';
+import { BaseRuntimeClient } from '@vibesdotdev/runtime-client';
+const DO_API_BASE = 'https://api.digitalocean.com/v2';
+function authHeader() {
+    const token = getRuntimeEnv('DIGITALOCEAN_API_TOKEN') ?? '';
+    if (!token) {
+        throw new Error('DIGITALOCEAN_API_TOKEN is not set. Generate one at https://cloud.digitalocean.com/account/api/tokens and set it in your env.');
+    }
+    return `Bearer ${token}`;
+}
+async function doFetch(path, init) {
+    const response = await fetch(`${DO_API_BASE}${path}`, {
+        ...init,
+        headers: {
+            Authorization: authHeader(),
+            'Content-Type': 'application/json',
+            ...(init?.headers ?? {})
+        }
+    });
+    if (!response.ok) {
+        const body = await response.text();
+        throw new Error(`DO API ${response.status} ${path}: ${body}`);
+    }
+    if (response.status === 204)
+        return undefined;
+    return (await response.json());
+}
+function buildAppSpec(deployment, options) {
+    const envs = deployment.env
+        .filter((requirement) => typeof requirement.value === 'string')
+        .map((requirement) => ({
+        key: requirement.name,
+        value: requirement.value,
+        scope: 'RUN_AND_BUILD_TIME',
+        type: (requirement.secret ? 'SECRET' : 'GENERAL')
+    }));
+    const github = {
+        repo: options.git?.repoCloneUrl,
+        branch: options.git?.branch ?? 'main',
+        deploy_on_push: false
+    };
+    const isStaticRuntime = deployment.runtime === 'browser' || deployment.runtime === 'edge';
+    const sourceDir = deployment.build.appDir;
+    const outputDir = deployment.build.outputDir;
+    if (isStaticRuntime) {
+        return {
+            name: deployment.appId,
+            region: options.region ?? 'nyc',
+            static_sites: [
+                {
+                    name: deployment.appId,
+                    build_command: deployment.build.buildCommand,
+                    source_dir: sourceDir,
+                    output_dir: outputDir,
+                    github: options.git?.repoCloneUrl ? github : undefined,
+                    envs
+                }
+            ]
+        };
+    }
+    return {
+        name: deployment.appId,
+        region: options.region ?? 'nyc',
+        services: [
+            {
+                name: deployment.appId,
+                instance_count: 1,
+                instance_size_slug: 'apps-s-1vcpu-0.5gb',
+                http_port: 3000,
+                build_command: deployment.build.buildCommand,
+                run_command: 'node build',
+                source_dir: sourceDir,
+                github: options.git?.repoCloneUrl ? github : undefined,
+                envs,
+                health_check: { http_path: '/' }
+            }
+        ]
+    };
+}
+export class DigitalOceanAppDeployClient extends BaseRuntimeClient {
+    constructor(descriptor = {
+        id: 'digitalocean-app-deploy',
+        kind: 'runtime/client'
+    }, context, runtime) {
+        super(descriptor, context, runtime);
+    }
+    async deployApp(options) {
+        const { deployment, onLine } = options;
+        const spec = buildAppSpec(deployment, options);
+        if (options.dryRun) {
+            onLine?.('stdout', `[dry-run] DO App spec for '${deployment.appId}':`);
+            onLine?.('stdout', JSON.stringify(spec, null, 2));
+            return { appId: options.appId ?? '(new)' };
+        }
+        if (options.appId) {
+            onLine?.('stdout', `Updating DO App ${options.appId}...`);
+            const updated = await doFetch(`/apps/${options.appId}`, {
+                method: 'PUT',
+                body: JSON.stringify({ spec })
+            });
+            return {
+                appId: updated.app.id,
+                liveUrl: updated.app.live_url
+            };
+        }
+        onLine?.('stdout', `Creating DO App '${deployment.appId}'...`);
+        const created = await doFetch(`/apps`, {
+            method: 'POST',
+            body: JSON.stringify({ spec })
+        });
+        return {
+            appId: created.app.id,
+            liveUrl: created.app.live_url
+        };
+    }
+}
+//# sourceMappingURL=digitalocean-app-deploy.client.js.map

package/dist/client/digitalocean-app-deploy.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digitalocean-app-deploy.client.js","sourceRoot":"","sources":["../../src/client/digitalocean-app-deploy.client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EACN,iBAAiB,EAEjB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAmEtD,SAAS,UAAU;IAClB,MAAM,KAAK,GAAG,aAAa,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACd,8HAA8H,CAC9H,CAAC;IACH,CAAC;IACD,OAAO,UAAU,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,OAAO,CAAI,IAAY,EAAE,IAAkB;IACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE,EAAE;QACrD,GAAG,IAAI;QACP,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,EAAE;YAC3B,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;SACxB;KACD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IACnD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CAAC,UAAyB,EAAE,OAAyB;IACzE,MAAM,IAAI,GAAgB,UAAU,CAAC,GAAG;SACtC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,CAAC;SAC9D,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACtB,GAAG,EAAE,WAAW,CAAC,IAAI;QACrB,KAAK,EAAE,WAAW,CAAC,KAAe;QAClC,KAAK,EAAE,oBAA6B;QACpC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAyB;KACzE,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAgB;QAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY;QAC/B,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,MAAM;QACrC,cAAc,EAAE,KAAK;KACrB,CAAC;IAEF,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC;IAC1F,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;IAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;IAE7C,IAAI,eAAe,EAAE,CAAC;QACrB,OAAO;YACN,IAAI,EAAE,UAAU,CAAC,KAAK;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;YAC/B,YAAY,EAAE;gBACb;oBACC,IAAI,EAAE,UAAU,CAAC,KAAK;oBACtB,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,YAAY;oBAC5C,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,SAAS;oBACrB,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBACtD,IAAI;iBACJ;aACD;SACD,CAAC;IACH,CAAC;IAED,OAAO;QACN,IAAI,EAAE,UAAU,CAAC,KAAK;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;QAC/B,QAAQ,EAAE;YACT;gBACC,IAAI,EAAE,UAAU,CAAC,KAAK;gBACtB,cAAc,EAAE,CAAC;gBACjB,kBAAkB,EAAE,oBAAoB;gBACxC,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,YAAY;gBAC5C,WAAW,EAAE,YAAY;gBACzB,UAAU,EAAE,SAAS;gBACrB,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBACtD,IAAI;gBACJ,YAAY,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;aAChC;SACD;KACD,CAAC;AACH,CAAC;AAED,MAAM,OAAO,2BAA4B,SAAQ,iBAAiB;IACjE,YACC,aAAsC;QACrC,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,gBAAgB;KACtB,EACD,OAAiB,EACjB,OAAsB;QAEtB,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAyB;QACxC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAE/C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,EAAE,CAAC,QAAQ,EAAE,8BAA8B,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC;YACvE,MAAM,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5C,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,EAAE,CAAC,QAAQ,EAAE,mBAAmB,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,OAAO,CAC5B,SAAS,OAAO,CAAC,KAAK,EAAE,EACxB;gBACC,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;aAC9B,CACD,CAAC;YACF,OAAO;gBACN,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;gBACrB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;aAC7B,CAAC;QACH,CAAC;QAED,MAAM,EAAE,CAAC,QAAQ,EAAE,oBAAoB,UAAU,CAAC,KAAK,MAAM,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,OAAO,CAA6C,OAAO,EAAE;YAClF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,OAAO;YACN,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;YACrB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;SAC7B,CAAC;IACH,CAAC;CACD"}

package/dist/client/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Public surface for the infra-doks runtime clients.
+ *
+ * Consumers resolve the App Platform deploy client via
+ * `getDigitalOceanAppDeployClient()` (preferred) or, for type-pinned generic
+ * resolution, `getVibesClient<DigitalOceanAppDeployClient>('digitalocean-app-deploy')`.
+ *
+ * Requires `doksPlugin` to be registered with the runtime so the
+ * `runtime/client` descriptor + loader for id `digitalocean-app-deploy` are
+ * resolvable.
+ */
+import { DigitalOceanAppDeployClient } from './digitalocean-app-deploy.client';
+export { DigitalOceanAppDeployClient, type DeployAppOptions, type DeployAppResult } from './digitalocean-app-deploy.client';
+export declare function getDigitalOceanAppDeployClient(): Promise<DigitalOceanAppDeployClient>;
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EACN,2BAA2B,EAC3B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,MAAM,kCAAkC,CAAC;AAE1C,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAE3F"}

package/dist/client/index.js

@@ -0,0 +1,18 @@
+/**
+ * Public surface for the infra-doks runtime clients.
+ *
+ * Consumers resolve the App Platform deploy client via
+ * `getDigitalOceanAppDeployClient()` (preferred) or, for type-pinned generic
+ * resolution, `getVibesClient<DigitalOceanAppDeployClient>('digitalocean-app-deploy')`.
+ *
+ * Requires `doksPlugin` to be registered with the runtime so the
+ * `runtime/client` descriptor + loader for id `digitalocean-app-deploy` are
+ * resolvable.
+ */
+import { getVibesClient } from '@vibesdotdev/runtime-client';
+import { DigitalOceanAppDeployClient } from './digitalocean-app-deploy.client.js';
+export { DigitalOceanAppDeployClient } from './digitalocean-app-deploy.client.js';
+export async function getDigitalOceanAppDeployClient() {
+    return getVibesClient('digitalocean-app-deploy');
+}
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EACN,2BAA2B,EAG3B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,8BAA8B;IACnD,OAAO,cAAc,CAA8B,yBAAyB,CAAC,CAAC;AAC/E,CAAC"}