@vibesdotdev/integrations-digitalocean 0.0.0-stage → 1.0.0-rc.1

package/dist/infra/billing.js

@@ -0,0 +1,43 @@
+import { BalanceSchema, PreviewSchema } from "../schemas/http.js";
+import { BillingSummarySchema, sanitizeInfraProviderFailure } from '@vibesdotdev/infra-core';
+const clean = (error) => sanitizeInfraProviderFailure(error).message;
+export class DigitalOceanBillingClient {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    getBalance() {
+        return this.client.get('/customers/my/balance', {}, BalanceSchema);
+    }
+    getInvoicePreviewSummary() {
+        return this.client.get('/customers/my/invoices/preview/summary', {}, PreviewSchema);
+    }
+    getBillingHistory() {
+        return this.client.get('/customers/my/billing_history');
+    }
+    async summary() {
+        const [b, p] = await Promise.allSettled([this.getBalance(), this.getInvoicePreviewSummary()]);
+        const errors = [];
+        if (b.status === 'rejected')
+            errors.push({ source: 'balance', message: clean(b.reason) });
+        if (p.status === 'rejected')
+            errors.push({ source: 'invoice-preview', message: clean(p.reason) });
+        const balance = b.status === 'fulfilled' ? b.value : undefined, preview = p.status === 'fulfilled' ? p.value : undefined;
+        const usd = (amount) => amount === undefined ? undefined : { currency: 'USD', amount };
+        return BillingSummarySchema.parse({
+            provider: 'digitalocean',
+            collectedAt: balance?.generated_at ?? new Date().toISOString(),
+            accountBalance: usd(balance?.account_balance),
+            monthToDateUsage: usd(balance?.month_to_date_usage),
+            monthToDateBalance: usd(balance?.month_to_date_balance),
+            grossProductCharges: usd(preview?.product_charges?.amount),
+            invoiceCreditsAndAdjustments: usd(preview?.credits_and_adjustments?.amount),
+            sponsorshipCredits: {
+                status: 'unknown',
+                reason: 'DigitalOcean billing APIs used by this command do not prove remaining sponsorship credit or expiry; inspect the authenticated Billing Credits surface.'
+            },
+            errors
+        });
+    }
+}
+//# sourceMappingURL=billing.js.map

package/dist/infra/billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../../src/infra/billing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,EACN,oBAAoB,EACpB,4BAA4B,EAE5B,MAAM,yBAAyB,CAAC;AAWjC,MAAM,KAAK,GAAG,CAAC,KAAkD,EAAE,EAAE,CACpE,4BAA4B,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC7C,MAAM,OAAO,yBAAyB;IACR;IAA7B,YAA6B,MAAsC;QAAtC,WAAM,GAAN,MAAM,CAAgC;IAAG,CAAC;IACvE,UAAU;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAU,uBAAuB,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;IAC7E,CAAC;IACD,wBAAwB;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAU,wCAAwC,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;IAC9F,CAAC;IACD,iBAAiB;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,CAAC,OAAO;QACZ,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAC9F,MAAM,MAAM,GAA6B,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAC7D,OAAO,GAAG,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,MAAM,GAAG,GAAG,CAAC,MAAe,EAAE,EAAE,CAC/B,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChE,OAAO,oBAAoB,CAAC,KAAK,CAAC;YACjC,QAAQ,EAAE,cAAc;YACxB,WAAW,EAAE,OAAO,EAAE,YAAY,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC9D,cAAc,EAAE,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC;YAC7C,gBAAgB,EAAE,GAAG,CAAC,OAAO,EAAE,mBAAmB,CAAC;YACnD,kBAAkB,EAAE,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC;YACvD,mBAAmB,EAAE,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC;YAC1D,4BAA4B,EAAE,GAAG,CAAC,OAAO,EAAE,uBAAuB,EAAE,MAAM,CAAC;YAC3E,kBAAkB,EAAE;gBACnB,MAAM,EAAE,SAAS;gBACjB,MAAM,EACL,wJAAwJ;aACzJ;YACD,MAAM;SACN,CAAC,CAAC;IACJ,CAAC;CACD"}

package/dist/infra/credentials.d.ts

@@ -0,0 +1,11 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { StoreOperationContext } from '@vibesdotdev/secrets';
+import { DigitalOceanControlPlaneClient } from '../client/control-plane.ts';
+import type { DigitalOceanTokenCredentialCandidate } from '../schemas/control-plane.ts';
+/**
+ * Construct a safe control-plane facade for the runtime's ordered credential
+ * candidates. Resolution and the authenticated request remain in the registered
+ * digitalocean-client-factory and Secrets client.
+ */
+export declare function createDigitalOceanProviderControlPlaneClient(runtime: VibesRuntime, candidates?: readonly DigitalOceanTokenCredentialCandidate[], operation?: StoreOperationContext): Promise<DigitalOceanControlPlaneClient>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/infra/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACN,8BAA8B,EAE9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,6BAA6B,CAAC;AAExF;;;;GAIG;AACH,wBAAsB,4CAA4C,CACjE,OAAO,EAAE,YAAY,EACrB,UAAU,CAAC,EAAE,SAAS,oCAAoC,EAAE,EAC5D,SAAS,CAAC,EAAE,qBAAqB,GAC/B,OAAO,CAAC,8BAA8B,CAAC,CAQzC"}

package/dist/infra/credentials.js

@@ -0,0 +1,15 @@
+import { DigitalOceanControlPlaneClient } from "../client/control-plane.js";
+/**
+ * Construct a safe control-plane facade for the runtime's ordered credential
+ * candidates. Resolution and the authenticated request remain in the registered
+ * digitalocean-client-factory and Secrets client.
+ */
+export async function createDigitalOceanProviderControlPlaneClient(runtime, candidates, operation) {
+    const options = {};
+    if (candidates !== undefined)
+        options.credentialCandidates = candidates;
+    if (operation !== undefined)
+        options.operation = operation;
+    return DigitalOceanControlPlaneClient.fromRuntime(runtime, options);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/infra/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,8BAA8B,EAE9B,MAAM,4BAA4B,CAAC;AAGpC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4CAA4C,CACjE,OAAqB,EACrB,UAA4D,EAC5D,SAAiC;IAEjC,MAAM,OAAO,GAGT,EAAE,CAAC;IACP,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,oBAAoB,GAAG,UAAU,CAAC;IACxE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAC3D,OAAO,8BAA8B,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC"}

package/dist/infra/deployment-provider/deploy-secrets.d.ts

@@ -0,0 +1,10 @@
+import type { DigitalOceanAppWebAppConfig } from '../../schemas/app-platform.ts';
+/**
+ * Pull typed App Platform config out of a deployment module export.
+ * A recognized malformed export refuses before any credential access or HTTP;
+ * silently treating it as absent could lose an existing App id and CREATE a duplicate.
+ */
+export declare function extractDigitalOceanAppConfig(exported: unknown): DigitalOceanAppWebAppConfig | undefined;
+/** The ledger's provider trace for an App and its deployment. */
+export declare function digitalOceanProviderTraceRef(appId: string | undefined, deploymentId: string | undefined): string | undefined;
+//# sourceMappingURL=deploy-secrets.d.ts.map

package/dist/infra/deployment-provider/deploy-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-secrets.d.ts","sourceRoot":"","sources":["../../../src/infra/deployment-provider/deploy-secrets.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAGjF;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,OAAO,GAAG,2BAA2B,GAAG,SAAS,CA2DvG;AAED,iEAAiE;AACjE,wBAAgB,4BAA4B,CAC3C,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,YAAY,EAAE,MAAM,GAAG,SAAS,GAC9B,MAAM,GAAG,SAAS,CAKpB"}

package/dist/infra/deployment-provider/deploy-secrets.js

@@ -0,0 +1,66 @@
+/**
+ * Pure App Platform provider projections: recognize the declared config shape
+ * and build a value-free trace reference.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { DIGITALOCEAN_APPS_ADAPTER_ID, DigitalOceanAppAdapterConfigSchema, DigitalOceanAppExportCandidateSchema, DigitalOceanAppExportContainerSchema } from "../../schemas/app-deployment.js";
+/**
+ * Pull typed App Platform config out of a deployment module export.
+ * A recognized malformed export refuses before any credential access or HTTP;
+ * silently treating it as absent could lose an existing App id and CREATE a duplicate.
+ */
+export function extractDigitalOceanAppConfig(exported) {
+    const parsedRaw = DigitalOceanAppExportContainerSchema.safeParse(exported);
+    if (!parsedRaw.success)
+        return undefined;
+    const container = parsedRaw.data;
+    const candidates = [];
+    if (Object.hasOwn(container, 'digitaloceanApp')) {
+        candidates.push({ key: 'digitaloceanApp', value: container.digitaloceanApp });
+    }
+    if (Object.hasOwn(container, 'digitalocean')) {
+        candidates.push({ key: 'digitalocean', value: container.digitalocean });
+    }
+    if (Object.hasOwn(container, 'doApp')) {
+        candidates.push({ key: 'doApp', value: container.doApp });
+    }
+    const appConfigAdapter = DigitalOceanAppAdapterConfigSchema.safeParse(container.appConfig);
+    if (Object.hasOwn(container, 'appConfig') &&
+        appConfigAdapter.success &&
+        appConfigAdapter.data.adapter === DIGITALOCEAN_APPS_ADAPTER_ID) {
+        candidates.push({ key: 'appConfig', value: container.appConfig });
+    }
+    const configAdapter = DigitalOceanAppAdapterConfigSchema.safeParse(container.config);
+    if (Object.hasOwn(container, 'config') &&
+        configAdapter.success &&
+        configAdapter.data.adapter === DIGITALOCEAN_APPS_ADAPTER_ID) {
+        candidates.push({ key: 'config', value: container.config });
+    }
+    for (const candidate of candidates) {
+        const parsed = DigitalOceanAppExportCandidateSchema.safeParse({ key: candidate.key, config: candidate.value });
+        if (parsed.success)
+            return parsed.data.config;
+        throw new CapabilityError(`The supplied DigitalOcean App configuration under '${candidate.key}' is malformed.`, 'INVALID_INPUT', {
+            reason: 'digitalocean-app-config-invalid',
+            retryable: false,
+            details: {
+                key: candidate.key,
+                problem: 'app-config-invalid',
+                issues: parsed.error.issues.map((issue) => ({ path: issue.path.join('.'), message: issue.message })).slice(0, 20)
+            },
+            recoveryHint: 'Fix the digitaloceanApp export; it is validated before credentials resolve or any request is made.'
+        });
+    }
+    return undefined;
+}
+/** The ledger's provider trace for an App and its deployment. */
+export function digitalOceanProviderTraceRef(appId, deploymentId) {
+    if (appId && deploymentId)
+        return `digitalocean-app://apps/${appId}/deployments/${deploymentId}`;
+    if (deploymentId)
+        return `digitalocean-app://deployments/${deploymentId}`;
+    if (appId)
+        return `digitalocean-app://apps/${appId}`;
+    return undefined;
+}
+//# sourceMappingURL=deploy-secrets.js.map

package/dist/infra/deployment-provider/deploy-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-secrets.js","sourceRoot":"","sources":["../../../src/infra/deployment-provider/deploy-secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EACN,4BAA4B,EAC5B,kCAAkC,EAClC,oCAAoC,EACpC,oCAAoC,EACpC,MAAM,iCAAiC,CAAC;AAIzC;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAiB;IAC7D,MAAM,SAAS,GAAG,oCAAoC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC;IAKjC,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACjD,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;QAC9C,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,gBAAgB,GAAG,kCAAkC,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3F,IACC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;QACrC,gBAAgB,CAAC,OAAO;QACxB,gBAAgB,CAAC,IAAI,CAAC,OAAO,KAAK,4BAA4B,EAC7D,CAAC;QACF,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,aAAa,GAAG,kCAAkC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrF,IACC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC;QAClC,aAAa,CAAC,OAAO;QACrB,aAAa,CAAC,IAAI,CAAC,OAAO,KAAK,4BAA4B,EAC1D,CAAC;QACF,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/G,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAE9C,MAAM,IAAI,eAAe,CACxB,sDAAsD,SAAS,CAAC,GAAG,iBAAiB,EACpF,eAAe,EACf;YACC,MAAM,EAAE,iCAAiC;YACzC,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE;gBACR,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,OAAO,EAAE,oBAAoB;gBAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aACjH;YACD,YAAY,EAAE,oGAAoG;SAClH,CACD,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,4BAA4B,CAC3C,KAAyB,EACzB,YAAgC;IAEhC,IAAI,KAAK,IAAI,YAAY;QAAE,OAAO,2BAA2B,KAAK,gBAAgB,YAAY,EAAE,CAAC;IACjG,IAAI,YAAY;QAAE,OAAO,kCAAkC,YAAY,EAAE,CAAC;IAC1E,IAAI,KAAK;QAAE,OAAO,2BAA2B,KAAK,EAAE,CAAC;IACrD,OAAO,SAAS,CAAC;AAClB,CAAC"}

package/dist/infra/deployment-provider/digitalocean-deployment-provider.impl.d.ts

@@ -0,0 +1,96 @@
+/**
+ * DigitalOcean App Platform deployment provider.
+ *
+ * Planning and dry-run produce value-free evidence without resolving credentials,
+ * starting processes, or contacting DigitalOcean. Execution resolves credentials
+ * through its runtime clients and delivers them only to the HTTP and Secrets
+ * mutation seams.
+ */
+import { type KindContext, type VibesRuntime } from '@vibesdotdev/kernel';
+import type { RuntimeDescriptor } from '@vibesdotdev/kernel/schemas/descriptor';
+import { type JsonObject } from '@vibesdotdev/kernel/schemas/json';
+import { type DeploymentArtifactOptions, type DeploymentArtifactResult, type DeploymentInspection, type DeploymentInspectionOptions, type DeploymentRollbackOutcome, type DeploymentProviderEnvironment, type DeploymentProviderImplementation, type DeploymentReleaseOptions, type DeploymentReleaseResult } from '@vibesdotdev/infra-core/kinds';
+import { type WebAppDescriptor, type WebAppProjectionOptions } from '@vibesdotdev/infra-core';
+/** Constructed by the kernel for the digitalocean-app descriptor with its resolving runtime. */
+export declare class DigitalOceanAppDeploymentProvider implements DeploymentProviderImplementation {
+    #private;
+    readonly descriptor: RuntimeDescriptor;
+    constructor(descriptor: RuntimeDescriptor, context: KindContext<VibesRuntime>);
+    projectWebApp(descriptor: WebAppDescriptor, _options: WebAppProjectionOptions): Promise<{
+        deployment: {
+            appId: string;
+            appName: string;
+            provider: string;
+            runtime: "worker" | "browser" | "edge" | "node";
+            build: {
+                workspaceRootDir: string;
+                appDir: string;
+                buildCommand: string;
+                outputDir: string;
+                installCommand?: string | undefined;
+            };
+            origins: {
+                hostname: string;
+                origin: string;
+                kind: "internal" | "redirect" | "preview" | "primary" | "alias";
+                description?: string | undefined;
+            }[];
+            env: {
+                name: string;
+                public?: boolean | undefined;
+                required?: boolean | undefined;
+                value?: string | undefined;
+                secret?: boolean | undefined;
+                description?: string | undefined;
+                storeKey?: string | undefined;
+                storeBinding?: boolean | undefined;
+            }[];
+            dependsOn: {
+                appId: string;
+                reason: string;
+                required: boolean;
+            }[];
+            upstreams: {
+                name: string;
+                origin: string;
+                purpose: string;
+                originEnvVar?: string | undefined;
+            }[];
+            tags: string[];
+            kvNamespaces: {
+                binding: string;
+                id: string;
+                preview_id?: string | undefined;
+            }[];
+            preDeployCommands: {
+                command: string;
+                description?: string | undefined;
+            }[];
+            execution?: {
+                pty?: boolean | undefined;
+                shell?: boolean | undefined;
+                maxSessions?: number | undefined;
+            } | undefined;
+            migrations?: {
+                requiredForLocalDev: boolean;
+            } | undefined;
+        };
+        provider: string;
+        managed: boolean;
+        workerName: string | null;
+        artifact: {
+            content: string;
+            filename: string;
+            path: string;
+            metadata?: Record<string, unknown> | undefined;
+        } | null;
+    }>;
+    validateOptions(options: JsonObject): void;
+    environment(): Promise<DeploymentProviderEnvironment>;
+    release(options: DeploymentReleaseOptions): Promise<DeploymentReleaseResult>;
+    inspect(options: DeploymentInspectionOptions): Promise<DeploymentInspection>;
+    regenerate(options: DeploymentArtifactOptions): Promise<DeploymentArtifactResult>;
+    rollback(): Promise<DeploymentRollbackOutcome>;
+}
+export default DigitalOceanAppDeploymentProvider;
+//# sourceMappingURL=digitalocean-deployment-provider.impl.d.ts.map

package/dist/infra/deployment-provider/digitalocean-deployment-provider.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digitalocean-deployment-provider.impl.d.ts","sourceRoot":"","sources":["../../../src/infra/deployment-provider/digitalocean-deployment-provider.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAmB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAG3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAMN,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,EAClC,KAAK,gCAAgC,EACrC,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAA0B,KAAK,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AA6EtH,gGAAgG;AAChG,qBAAa,iCAAkC,YAAW,gCAAgC;;IAG7E,QAAQ,CAAC,UAAU,EAAE,iBAAiB;gBAA7B,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC;IAIhF,aAAa,CAAC,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IASnF,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI;IAIpC,WAAW,IAAI,OAAO,CAAC,6BAA6B,CAAC;IAIrD,OAAO,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAiI5E,OAAO,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA2B5E,UAAU,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAQjF,QAAQ,IAAI,OAAO,CAAC,yBAAyB,CAAC;CAMpD;AAED,eAAe,iCAAiC,CAAC"}

package/dist/infra/deployment-provider/digitalocean-deployment-provider.impl.js

@@ -0,0 +1,242 @@
+/**
+ * DigitalOcean App Platform deployment provider.
+ *
+ * Planning and dry-run produce value-free evidence without resolving credentials,
+ * starting processes, or contacting DigitalOcean. Execution resolves credentials
+ * through its runtime clients and delivers them only to the HTTP and Secrets
+ * mutation seams.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { prepareRegistryStandaloneBuildContext } from '@vibesdotdev/registry/standalone-install';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { DeploymentArtifactResultSchema, DeploymentEnvironmentFactsSchema, DeploymentProviderEnvironmentSchema, DeploymentReadinessCheckSchema, DeploymentReleaseResultSchema } from '@vibesdotdev/infra-core/kinds';
+import { WebAppProjectionSchema } from '@vibesdotdev/infra-core';
+import { DigitalOceanAppWebAppConfigSchema } from "../../schemas/app-platform.js";
+import { getDigitalOceanClientFactory } from "../../client/helpers.js";
+import { DigitalOceanReleaseOptionsSchema } from "../../schemas/app-deployment.js";
+import { loadDigitalOceanImagePublishSettings } from "../../secrets/container-registry/image-publish-settings.descriptor.js";
+import { digitalOceanProviderTraceRef, extractDigitalOceanAppConfig } from "./deploy-secrets.js";
+import { publishDigitalOceanAppImage, requireImagePublishSettings, resolveDigitalOceanImageTag, shouldPublishDigitalOceanContainerImage } from "./image-publish.js";
+const IMMUTABLE_IMAGE_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/i;
+async function withBuildContextCleanup(context, work) {
+    let result;
+    try {
+        result = await work();
+    }
+    catch (failure) {
+        if (context) {
+            try {
+                await context.cleanup();
+            }
+            catch (cleanup) {
+                throw new AggregateError([failure, cleanup], 'Image publication and build context cleanup failed.', {
+                    cause: failure
+                });
+            }
+        }
+        throw failure;
+    }
+    await context?.cleanup();
+    return result;
+}
+function assertImmutableImageDigest(digest) {
+    if (digest && IMMUTABLE_IMAGE_DIGEST_PATTERN.test(digest)) {
+        return digest.toLowerCase();
+    }
+    throw new CapabilityError('DigitalOcean container image deployment requires an immutable sha256 digest.', 'UNAVAILABLE', {
+        reason: 'digitalocean-image-digest-missing',
+        retryable: false,
+        recoveryHint: 'Publish or configure the container image with an immutable sha256:<64-hex> digest.'
+    });
+}
+function readReleaseOptions(options) {
+    const parsed = DigitalOceanReleaseOptionsSchema.safeParse(options);
+    if (!parsed.success) {
+        throw new CapabilityError('Invalid DigitalOcean deploy options.', 'INVALID_INPUT', {
+            reason: 'digitalocean-deploy-options-invalid',
+            retryable: false,
+            details: { issues: parsed.error.issues.map((issue) => ({ path: issue.path.join('.'), message: issue.message })) }
+        });
+    }
+    return parsed.data;
+}
+/** Constructed by the kernel for the digitalocean-app descriptor with its resolving runtime. */
+export class DigitalOceanAppDeploymentProvider {
+    descriptor;
+    #runtime;
+    constructor(descriptor, context) {
+        this.descriptor = descriptor;
+        this.#runtime = context.runtime;
+    }
+    async projectWebApp(descriptor, _options) {
+        DigitalOceanAppWebAppConfigSchema.parse(descriptor.config);
+        return WebAppProjectionSchema.parse({
+            deployment: descriptor.deployment, provider: descriptor.deployment.provider,
+            managed: false, workerName: descriptor.config.digitaloceanAppName ?? descriptor.deployment.appId,
+            artifact: null
+        });
+    }
+    validateOptions(options) {
+        readReleaseOptions(options);
+    }
+    async environment() {
+        return DeploymentProviderEnvironmentSchema.parse({ variables: {}, projected: false });
+    }
+    async release(options) {
+        const runtime = this.#runtime;
+        const flags = readReleaseOptions(options.options);
+        const { deployment, dryRun, onLine, log } = options;
+        const appConfig = extractDigitalOceanAppConfig(options.module.exported);
+        const appId = flags.doAppId ?? appConfig?.id;
+        const doRegion = flags.doRegion ?? appConfig?.region;
+        const doDryRunSpec = flags.doDryRunSpec === true;
+        const isDryRun = dryRun || doDryRunSpec;
+        const immutableRelease = Boolean(options.source.compositionDigest);
+        const git = flags.doGitRepo
+            ? { repoCloneUrl: flags.doGitRepo, branch: flags.doGitBranch ?? options.source.branch }
+            : undefined;
+        const factory = await getDigitalOceanClientFactory(runtime);
+        let effectiveAppConfig = appConfig;
+        if (!isDryRun) {
+            if (immutableRelease && !options.host.assertSource) {
+                throw new CapabilityError('Immutable DigitalOcean release requires a workspace source verifier.', 'CONFLICT', { reason: 'workspace-source-verifier-missing', retryable: false });
+            }
+            if (immutableRelease && flags.doGitRepo) {
+                throw new CapabilityError('Immutable DigitalOcean release cannot deploy from a mutable remote Git branch.', 'INVALID_INPUT', {
+                    reason: 'digitalocean-git-source-mutable',
+                    retryable: false,
+                    details: {
+                        repoCloneUrl: flags.doGitRepo,
+                        branch: flags.doGitBranch ?? options.source.branch ?? null
+                    }
+                });
+            }
+            await options.host.assertSource?.();
+            const wantsImage = shouldPublishDigitalOceanContainerImage({
+                appConfig,
+                doGitRepo: flags.doGitRepo
+            });
+            const publishSettings = wantsImage
+                ? requireImagePublishSettings(await loadDigitalOceanImagePublishSettings(runtime))
+                : undefined;
+            if (wantsImage && publishSettings && appConfig?.dockerfilePath) {
+                const appRepositoryRoot = options.repositoryRoot ?? options.workspaceRoot;
+                const context = appConfig.registryStandaloneContext
+                    ? await prepareRegistryStandaloneBuildContext(runtime, { cwd: appRepositoryRoot })
+                    : undefined;
+                const dockerfilePath = appConfig.dockerfilePath;
+                const published = await withBuildContextCleanup(context, async () => {
+                    await context?.verify();
+                    await options.host.assertSource?.();
+                    const image = await publishDigitalOceanAppImage({
+                        runtime,
+                        appRepositoryRoot,
+                        dockerfilePath,
+                        standaloneContext: context?.directory,
+                        repository: deployment.appId,
+                        tag: resolveDigitalOceanImageTag(runtime, options.source.commit),
+                        settings: publishSettings,
+                        onLine
+                    });
+                    await context?.verify();
+                    return image;
+                });
+                const digest = assertImmutableImageDigest(published.digest);
+                await options.host.assertSource?.();
+                effectiveAppConfig = { ...appConfig, containerImage: { ...published, digest } };
+                onLine('stdout', '[digitalocean] published container image ' + published.registry + '/' + published.repository + ':' + published.tag + '@' + digest);
+            }
+            else if (immutableRelease && effectiveAppConfig?.containerImage) {
+                const digest = assertImmutableImageDigest(effectiveAppConfig.containerImage.digest);
+                effectiveAppConfig = {
+                    ...effectiveAppConfig,
+                    containerImage: { ...effectiveAppConfig.containerImage, digest }
+                };
+            }
+        }
+        const client = factory.createAppDeploy({ credentialLog: log });
+        const result = await client.deployApp({
+            deployment,
+            appId,
+            appConfig: effectiveAppConfig,
+            region: doRegion,
+            git,
+            dryRun,
+            dryRunSpec: doDryRunSpec,
+            waitForActive: !isDryRun || flags.doWait,
+            waitTimeoutMs: flags.doWaitTimeout,
+            onLine
+        });
+        const tail = result.phase ? ' [phase=' + result.phase + ']' : '';
+        const summary = doDryRunSpec
+            ? 'Printed safe App deployment evidence for ' + deployment.appId + ' (no API call).'
+            : dryRun
+                ? 'Planned DO App ' + deployment.appId + ' without credentials or API calls.'
+                : result.liveUrl
+                    ? 'Deployed DO App ' + result.appId + ' at ' + result.liveUrl + tail
+                    : 'Deployed DO App ' + result.appId + tail;
+        const fields = { appId: result.appId };
+        if (result.liveUrl !== undefined)
+            fields.liveUrl = result.liveUrl;
+        if (result.phase !== undefined)
+            fields.phase = result.phase;
+        if (result.deploymentId !== undefined)
+            fields.deploymentId = result.deploymentId;
+        if (effectiveAppConfig?.containerImage?.digest !== undefined) {
+            fields.imageDigest = effectiveAppConfig.containerImage.digest;
+        }
+        if (result.spec !== undefined)
+            fields.spec = JsonValueSchema.parse(result.spec);
+        return DeploymentReleaseResultSchema.parse({
+            status: isDryRun ? 'dry-run' : 'released',
+            deployedUrl: result.liveUrl,
+            externalDeploymentId: result.deploymentId,
+            providerTraceRef: digitalOceanProviderTraceRef(result.appId, result.deploymentId),
+            probe: !isDryRun,
+            notes: result.phase ? 'phase=' + result.phase : doDryRunSpec ? 'dry-run-spec' : undefined,
+            summary,
+            result: fields
+        });
+    }
+    async inspect(options) {
+        const { deployment } = options;
+        const routes = options.environment === 'production'
+            ? deployment.origins.filter((origin) => origin.kind === 'primary' || origin.kind === 'redirect').map((origin) => origin.hostname)
+            : [];
+        return {
+            facts: DeploymentEnvironmentFactsSchema.parse({
+                generated: false,
+                resolved: true,
+                providerEnvironment: null,
+                explicitEnvironment: true,
+                routesInherited: false,
+                routes,
+                boundSecrets: [],
+                declaredRequirements: deployment.env.filter((entry) => entry.secret && entry.required !== false).map((entry) => entry.name)
+            }),
+            checks: [DeploymentReadinessCheckSchema.parse({
+                    id: 'generated-config',
+                    label: 'Generated provider config',
+                    status: 'pass',
+                    summary: 'No generated provider config is required for ' + this.descriptor.id + '.',
+                    evidence: ['provider: ' + this.descriptor.id],
+                    action: null
+                })]
+        };
+    }
+    async regenerate(options) {
+        return DeploymentArtifactResultSchema.parse({
+            status: 'skipped',
+            path: options.appDir,
+            reason: 'DigitalOcean App Platform renders its App spec at deploy; no committed provider artifact.'
+        });
+    }
+    async rollback() {
+        throw new CapabilityError('DigitalOcean App Platform rollback is not available through vibes infra deploy rollback.', 'UNAVAILABLE', {
+            reason: 'deployment-rollback-unsupported',
+            retryable: false
+        });
+    }
+}
+export default DigitalOceanAppDeploymentProvider;
+//# sourceMappingURL=digitalocean-deployment-provider.impl.js.map

package/dist/infra/deployment-provider/digitalocean-deployment-provider.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digitalocean-deployment-provider.impl.js","sourceRoot":"","sources":["../../../src/infra/deployment-provider/digitalocean-deployment-provider.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,eAAe,EAAuC,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,qCAAqC,EAAE,MAAM,0CAA0C,CAAC;AAGjG,OAAO,EAAE,eAAe,EAAmB,MAAM,kCAAkC,CAAC;AACpF,OAAO,EACN,8BAA8B,EAC9B,gCAAgC,EAChC,mCAAmC,EACnC,8BAA8B,EAC9B,6BAA6B,EAU7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAuD,MAAM,yBAAyB,CAAC;AACtH,OAAO,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAGvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,oCAAoC,EAAE,MAAM,uEAAuE,CAAC;AAC7H,OAAO,EACN,4BAA4B,EAC5B,4BAA4B,EAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,uCAAuC,EACvC,MAAM,oBAAoB,CAAC;AAE5B,MAAM,8BAA8B,GAAG,wBAAwB,CAAC;AAShE,KAAK,UAAU,uBAAuB,CACrC,OAA2C,EAC3C,IAAsB;IAEtB,IAAI,MAAS,CAAC;IACd,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QAClB,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,cAAc,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,qDAAqD,EAAE;oBACnG,KAAK,EAAE,OAAO;iBACd,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QACD,MAAM,OAAO,CAAC;IACf,CAAC;IACD,MAAM,OAAO,EAAE,OAAO,EAAE,CAAC;IACzB,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CAAC,MAA0B;IAC7D,IAAI,MAAM,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,eAAe,CACxB,8EAA8E,EAC9E,aAAa,EACb;QACC,MAAM,EAAE,mCAAmC;QAC3C,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,oFAAoF;KAClG,CACD,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAmB;IAC9C,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,sCAAsC,EAAE,eAAe,EAAE;YAClF,MAAM,EAAE,qCAAqC;YAC7C,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE;SACjH,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,gGAAgG;AAChG,MAAM,OAAO,iCAAiC;IAGxB;IAFZ,QAAQ,CAAe;IAEhC,YAAqB,UAA6B,EAAE,OAAkC;QAAjE,eAAU,GAAV,UAAU,CAAmB;QACjD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAA4B,EAAE,QAAiC;QAClF,iCAAiC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,sBAAsB,CAAC,KAAK,CAAC;YACnC,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,QAAQ;YAC3E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,mBAAmB,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK;YAChG,QAAQ,EAAE,IAAI;SACd,CAAC,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,OAAmB;QAClC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,WAAW;QAChB,OAAO,mCAAmC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAiC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACpD,MAAM,SAAS,GAAG,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS,EAAE,MAAM,CAAC;QACrD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,YAAY,CAAC;QACxC,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS;YAC1B,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;YACvF,CAAC,CAAC,SAAS,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,kBAAkB,GAAG,SAAS,CAAC;QAEnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,IAAI,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpD,MAAM,IAAI,eAAe,CACxB,sEAAsE,EACtE,UAAU,EACV,EAAE,MAAM,EAAE,mCAAmC,EAAE,SAAS,EAAE,KAAK,EAAE,CACjE,CAAC;YACH,CAAC;YACD,IAAI,gBAAgB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACzC,MAAM,IAAI,eAAe,CACxB,gFAAgF,EAChF,eAAe,EACf;oBACC,MAAM,EAAE,iCAAiC;oBACzC,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE;wBACR,YAAY,EAAE,KAAK,CAAC,SAAS;wBAC7B,MAAM,EAAE,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI;qBAC1D;iBACD,CACD,CAAC;YACH,CAAC;YACD,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YAEpC,MAAM,UAAU,GAAG,uCAAuC,CAAC;gBAC1D,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;aAC1B,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,UAAU;gBACjC,CAAC,CAAC,2BAA2B,CAAC,MAAM,oCAAoC,CAAC,OAAO,CAAC,CAAC;gBAClF,CAAC,CAAC,SAAS,CAAC;YACb,IAAI,UAAU,IAAI,eAAe,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC;gBAChE,MAAM,iBAAiB,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,aAAa,CAAC;gBAC1E,MAAM,OAAO,GAAG,SAAS,CAAC,yBAAyB;oBAClD,CAAC,CAAC,MAAM,qCAAqC,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;oBAClF,CAAC,CAAC,SAAS,CAAC;gBACb,MAAM,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC;gBAChD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;oBACnE,MAAM,OAAO,EAAE,MAAM,EAAE,CAAC;oBACxB,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;oBACpC,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC;wBAC/C,OAAO;wBACP,iBAAiB;wBACjB,cAAc;wBACd,iBAAiB,EAAE,OAAO,EAAE,SAAS;wBACrC,UAAU,EAAE,UAAU,CAAC,KAAK;wBAC5B,GAAG,EAAE,2BAA2B,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;wBAChE,QAAQ,EAAE,eAAe;wBACzB,MAAM;qBACN,CAAC,CAAC;oBACH,MAAM,OAAO,EAAE,MAAM,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAC;gBACd,CAAC,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAC5D,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACpC,kBAAkB,GAAG,EAAE,GAAG,SAAS,EAAE,cAAc,EAAE,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;gBAChF,MAAM,CACL,QAAQ,EACR,2CAA2C,GAAG,SAAS,CAAC,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAC,UAAU,GAAG,GAAG,GAAG,SAAS,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM,CAClI,CAAC;YACH,CAAC;iBAAM,IAAI,gBAAgB,IAAI,kBAAkB,EAAE,cAAc,EAAE,CAAC;gBACnE,MAAM,MAAM,GAAG,0BAA0B,CAAC,kBAAkB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBACpF,kBAAkB,GAAG;oBACpB,GAAG,kBAAkB;oBACrB,cAAc,EAAE,EAAE,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE;iBAChE,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC;YACrC,UAAU;YACV,KAAK;YACL,SAAS,EAAE,kBAAkB;YAC7B,MAAM,EAAE,QAAQ;YAChB,GAAG;YACH,MAAM;YACN,UAAU,EAAE,YAAY;YACxB,aAAa,EAAE,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM;YACxC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM;SACN,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,YAAY;YAC3B,CAAC,CAAC,2CAA2C,GAAG,UAAU,CAAC,KAAK,GAAG,iBAAiB;YACpF,CAAC,CAAC,MAAM;gBACP,CAAC,CAAC,iBAAiB,GAAG,UAAU,CAAC,KAAK,GAAG,oCAAoC;gBAC7E,CAAC,CAAC,MAAM,CAAC,OAAO;oBACf,CAAC,CAAC,kBAAkB,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI;oBACpE,CAAC,CAAC,kBAAkB,GAAG,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QAC9C,MAAM,MAAM,GAAe,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5D,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;YAAE,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACjF,IAAI,kBAAkB,EAAE,cAAc,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9D,MAAM,CAAC,WAAW,GAAG,kBAAkB,CAAC,cAAc,CAAC,MAAM,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEhF,OAAO,6BAA6B,CAAC,KAAK,CAAC;YAC1C,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YACzC,WAAW,EAAE,MAAM,CAAC,OAAO;YAC3B,oBAAoB,EAAE,MAAM,CAAC,YAAY;YACzC,gBAAgB,EAAE,4BAA4B,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;YACjF,KAAK,EAAE,CAAC,QAAQ;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;YACzF,OAAO;YACP,MAAM,EAAE,MAAM;SACd,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAoC;QACjD,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,KAAK,YAAY;YAClD,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjI,CAAC,CAAC,EAAE,CAAC;QACN,OAAO;YACN,KAAK,EAAE,gCAAgC,CAAC,KAAK,CAAC;gBAC7C,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,IAAI;gBACd,mBAAmB,EAAE,IAAI;gBACzB,mBAAmB,EAAE,IAAI;gBACzB,eAAe,EAAE,KAAK;gBACtB,MAAM;gBACN,YAAY,EAAE,EAAE;gBAChB,oBAAoB,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC3H,CAAC;YACF,MAAM,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC;oBAC7C,EAAE,EAAE,kBAAkB;oBACtB,KAAK,EAAE,2BAA2B;oBAClC,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,+CAA+C,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG;oBACnF,QAAQ,EAAE,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7C,MAAM,EAAE,IAAI;iBACZ,CAAC,CAAC;SACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAkC;QAClD,OAAO,8BAA8B,CAAC,KAAK,CAAC;YAC3C,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,OAAO,CAAC,MAAM;YACpB,MAAM,EAAE,2FAA2F;SACnG,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,MAAM,IAAI,eAAe,CAAC,0FAA0F,EAAE,aAAa,EAAE;YACpI,MAAM,EAAE,iCAAiC;YACzC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;CACD;AAED,eAAe,iCAAiC,CAAC"}

package/dist/infra/deployment-provider/image-publish.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Build and publish a Dockerfile App image through the Secrets execution owner.
+ */
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { ExecutionOutputLine } from '@vibesdotdev/kernel/execution';
+import type { DigitalOceanAppImageRef, DigitalOceanAppWebAppConfig } from '../../schemas/app-platform.ts';
+import type { DigitalOceanImagePublishSettings } from '../../schemas/app-deployment.ts';
+export declare const DIGITALOCEAN_CONTAINER_REGISTRY_HOST = "registry.digitalocean.com";
+/**
+ * Extract the immutable manifest digest (`sha256:<64-hex>`) emitted by `docker push`.
+ * Refuses when the registry push output reports no immutable digest.
+ */
+export declare function extractPublishedImageDigest(...outputs: Array<string | undefined>): string;
+export declare function shouldPublishDigitalOceanContainerImage(input: {
+    appConfig: DigitalOceanAppWebAppConfig | undefined;
+    doGitRepo: string | undefined;
+}): boolean;
+/** Prefer the immutable build version; fall back to the resolved source commit. */
+export declare function resolveDigitalOceanImageTag(runtime: Pick<VibesRuntime, 'getEnv'>, sourceCommit: string | undefined): string;
+export interface PublishDigitalOceanAppImageInput {
+    runtime: VibesRuntime;
+    appRepositoryRoot: string;
+    dockerfilePath: string;
+    standaloneContext?: string;
+    repository: string;
+    tag: string;
+    settings: DigitalOceanImagePublishSettings;
+    onLine?: ExecutionOutputLine;
+}
+/**
+ * Resolve the credential reference and spawn one supervised shell through
+ * Secrets. Docker login, build and push stay in that process tree; its config
+ * directory is temporary and removed on exit. The package never receives the
+ * token value, and every child output byte is redacted by the owner.
+ */
+export declare function publishDigitalOceanAppImage(input: PublishDigitalOceanAppImageInput): Promise<DigitalOceanAppImageRef>;
+/** Refuse a Dockerfile publish whose delivery settings were never composed. */
+export declare function requireImagePublishSettings(settings: DigitalOceanImagePublishSettings | undefined): DigitalOceanImagePublishSettings;
+//# sourceMappingURL=image-publish.d.ts.map

package/dist/infra/deployment-provider/image-publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-publish.d.ts","sourceRoot":"","sources":["../../../src/infra/deployment-provider/image-publish.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,KAAK,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC1G,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAExF,eAAO,MAAM,oCAAoC,8BAA8B,CAAC;AAMhF;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAgBzF;AAED,wBAAgB,uCAAuC,CAAC,KAAK,EAAE;IAC9D,SAAS,EAAE,2BAA2B,GAAG,SAAS,CAAC;IACnD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B,GAAG,OAAO,CAKV;AAED,mFAAmF;AACnF,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EACrC,YAAY,EAAE,MAAM,GAAG,SAAS,GAC9B,MAAM,CASR;AAED,MAAM,WAAW,gCAAgC;IAChD,OAAO,EAAE,YAAY,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,gCAAgC,CAAC;IAC3C,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AA+BD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAChD,KAAK,EAAE,gCAAgC,GACrC,OAAO,CAAC,uBAAuB,CAAC,CAmDlC;AAED,+EAA+E;AAC/E,wBAAgB,2BAA2B,CAC1C,QAAQ,EAAE,gCAAgC,GAAG,SAAS,GACpD,gCAAgC,CAalC"}