kadi-deploy 0.19.0

package/src/commands/deploy-local.ts

@@ -0,0 +1,475 @@
+/**
+ * Deploy Command - Local Docker/Podman Integration
+ *
+ * Main deployment command that uses deploy-ability library for local deployments.
+ * This replaces the old targets/local/local.ts with a clean interface to deploy-ability.
+ *
+ * @module commands/deploy-local
+ */
+
+import { deployToLocal } from '@kadi.build/deploy-ability/local';
+import type {
+  LocalDeploymentOptions,
+  LocalDeploymentData,
+  LocalDryRunData
+} from '@kadi.build/deploy-ability/types';
+
+import { loadAgentConfig, getProfile, getFirstProfile } from '../config/agent-loader.js';
+import {
+  waitForSecretRequest,
+  shareSecrets,
+  sendRejection,
+  readSecretsFromCli,
+  prepareSecretsForDeployment,
+  type WaitForSecretsResult,
+} from '../secrets/index.js';
+import { normalizeSecrets, hasAnySecrets, type NormalizedVaultSource } from '../secrets/normalize.js';
+import { startSpinner, succeedSpinner, failSpinner } from '../cli/spinners.js';
+import { confirmPrompt } from '../cli/prompts.js';
+import { error as errorColor, warning, success as successColor, formatKeyValue, formatHeader, dim, bold } from '../cli/colors.js';
+
+import type { DeploymentContext } from '../types.js';
+import type { Ora } from 'ora';
+import { buildLocalLock, writeLockFile } from './lock.js';
+
+/**
+ * Executes local Docker/Podman deployment using deploy-ability
+ *
+ * This function orchestrates the complete local deployment workflow:
+ * 1. Load agent configuration
+ * 2. Resolve profile
+ * 3. Build deployment options
+ * 4. Deploy using deploy-ability
+ * 5. Display results
+ *
+ * @param ctx - Deployment context from CLI
+ */
+export async function executeLocalDeployment(ctx: DeploymentContext): Promise<void> {
+  const { logger, projectRoot, flags } = ctx;
+
+  // ----------------------------------------------------------------
+  // 1. Load agent configuration
+  // ----------------------------------------------------------------
+  const spinner = startSpinner('Loading agent configuration...');
+
+  let agentConfig;
+  try {
+    agentConfig = await loadAgentConfig(projectRoot);
+    succeedSpinner(spinner, `Loaded agent: ${agentConfig.name}`);
+  } catch (err) {
+    failSpinner(spinner, 'Failed to load agent.json');
+    logger.error(errorColor((err as Error).message));
+    return;
+  }
+
+  // ----------------------------------------------------------------
+  // 2. Resolve profile
+  // ----------------------------------------------------------------
+  const profileName = flags.profile || getFirstProfile(agentConfig);
+
+  if (!profileName) {
+    logger.error('No deploy profiles found in agent.json');
+    logger.log('Add a deploy profile under the "deploy" field in agent.json');
+    return;
+  }
+
+  const profile = getProfile(agentConfig, profileName);
+  if (!profile) {
+    logger.error(`Profile "${profileName}" not found in agent.json`);
+    return;
+  }
+
+  // Validate it's a local profile
+  if (profile.target !== 'local') {
+    logger.error(`Profile "${profileName}" is not a local profile (target: ${profile.target})`);
+    return;
+  }
+
+  logger.log(successColor(`✓ Using profile: ${profileName}`));
+
+  // ----------------------------------------------------------------
+  // 2.5. SECRETS INJECTION
+  // If profile declares secrets, inject KADI_* env vars into all services
+  // Supports both legacy single-vault and multi-vault configurations.
+  // ----------------------------------------------------------------
+  const normalizedSecrets = normalizeSecrets(profile.secrets as any);
+  const hasSecrets = hasAnySecrets(normalizedSecrets);
+
+  let deployNonce: string | undefined;
+  let brokerUrl: string | null = null;
+  let secretsVault: string | undefined;
+  let secretsSources: NormalizedVaultSource[] = [];
+
+  if (hasSecrets) {
+    const result = prepareSecretsForDeployment({
+      profile,
+      agentConfig,
+      projectRoot,
+      logger,
+      colors: { dim, success: successColor, error: errorColor },
+    });
+
+    if (!result) return;
+
+    deployNonce = result.deployNonce;
+    brokerUrl = result.brokerUrl;
+    secretsVault = result.secretsVault;
+    secretsSources = result.secretsSources;
+  }
+
+  // ----------------------------------------------------------------
+  // 3. Build deployment options for deploy-ability
+  // ----------------------------------------------------------------
+
+  // Spinner reference for progress updates
+  let progressSpinner: Ora | null = null;
+
+  const deployOptions: LocalDeploymentOptions = {
+    projectRoot,
+    profile: profileName,
+    // Pass the transformed profile with injected env vars
+    loadedProfile: {
+      name: profileName,
+      profile,
+      agent: agentConfig,
+      projectRoot,
+    },
+    engine: profile.engine || flags.engine || 'docker',
+    dryRun: flags.dryRun || false,
+    verbose: flags.verbose || false,
+
+    // Progress callback - updates spinner with structured events
+    onProgress: (event) => {
+      if (progressSpinner && event.message) {
+        progressSpinner.text = event.message;
+      }
+    },
+
+    // Logger for deploy-ability to use (errors only, no progress messages)
+    logger: {
+      log: (msg: string) => logger.log(msg),
+      error: (msg: string) => logger.error(msg),
+      warn: (msg: string) => logger.log(warning(msg)),
+      debug: flags.verbose ? (msg: string) => logger.log(msg) : () => {}
+    }
+  };
+
+  // ----------------------------------------------------------------
+  // 4. Execute deployment using deploy-ability
+  // ----------------------------------------------------------------
+  if (flags.dryRun) {
+    logger.log('\n' + warning('⚠️  DRY RUN MODE - No deployment will be created'));
+  } else if (!flags.yes) {
+    // Confirm deployment
+    const proceed = await confirmPrompt(
+      `Deploy locally using ${deployOptions.engine}?`,
+      true
+    );
+
+    if (!proceed) {
+      logger.log('Deployment cancelled');
+      return;
+    }
+  }
+
+  // ----------------------------------------------------------------
+  // 4. Start listening for secrets BEFORE deploying (to avoid race condition)
+  // The agent may request secrets immediately after starting, so we need
+  // to be subscribed before the container starts.
+  // ----------------------------------------------------------------
+  let secretsPromise: Promise<WaitForSecretsResult> | null = null;
+
+  if (hasSecrets && deployNonce && brokerUrl && !flags.dryRun) {
+    logger.log(dim(`\nConnecting to broker to listen for secret requests...`));
+
+    // Start listening NOW (don't await - let it run in background)
+    secretsPromise = waitForSecretRequest({
+      brokerUrl,
+      expectedNonce: deployNonce,
+      timeout: 5 * 60 * 1000, // 5 minutes
+      logger: {
+        log: (msg: string) => logger.log(dim(msg)),
+        error: (msg: string) => logger.error(errorColor(msg)),
+      },
+    });
+
+    // Wait for broker subscription before starting containers
+    await new Promise(resolve => setTimeout(resolve, 1000));
+  }
+
+  // ----------------------------------------------------------------
+  // 5. Execute deployment using deploy-ability
+  // ----------------------------------------------------------------
+  progressSpinner = startSpinner(`Deploying locally with ${deployOptions.engine}...`);
+
+  try {
+    const result = await deployToLocal(deployOptions);
+
+    if (!result.success) {
+      failSpinner(progressSpinner, 'Deployment failed');
+      logger.error(errorColor(result.error.message));
+
+      // Show context details (command, exit code, stderr)
+      const err = result.error as unknown as { context?: Record<string, unknown> };
+      if (err.context) {
+        if (err.context.error) logger.error(`Error: ${err.context.error}`);
+        if (err.context.stderr) logger.error(`Stderr: ${err.context.stderr}`);
+        if (err.context.exitCode !== undefined) logger.error(`Exit code: ${err.context.exitCode}`);
+      }
+
+      if (flags.verbose && result.error.cause) {
+        logger.error('\nCause:', result.error.cause);
+      }
+
+      return;
+    }
+
+    succeedSpinner(progressSpinner, 'Deployment complete!');
+
+    // ----------------------------------------------------------------
+    // 6. Display results
+    // ----------------------------------------------------------------
+    const data = result.data;
+
+    if ('dryRun' in data && data.dryRun) {
+      // Dry run result
+      displayLocalDryRunInfo(profileName, data);
+    } else {
+      // Actual deployment result
+      const deploymentData = data as LocalDeploymentData;
+
+      if (flags.verbose) {
+        displayLocalDeploymentInfo(deploymentData);
+      } else {
+        displayLocalDeploymentSummary(deploymentData);
+      }
+
+      // ----------------------------------------------------------------
+      // 6.5. Write deployment lock file for `kadi deploy down`
+      // ----------------------------------------------------------------
+      try {
+        const lock = buildLocalLock(profileName, deploymentData, flags.label);
+        const instanceId = await writeLockFile(projectRoot, lock);
+        logger.log(dim(`  Instance: ${instanceId}  (profile: ${profileName}${flags.label ? `, label: ${flags.label}` : ''})`));
+        logger.log(dim(`  Use \`kadi deploy down --instance ${instanceId}\` to tear down.`));
+        if (flags.verbose) {
+          logger.log(dim('Lock file written: .kadi-deploy.lock'));
+        }
+      } catch (lockErr) {
+        // Non-fatal: deployment succeeded even if lock write fails
+        logger.log(warning(`Could not write lock file: ${(lockErr as Error).message}`));
+      }
+
+      // ----------------------------------------------------------------
+      // 7. Wait for secret request result (we started listening earlier)
+      // ----------------------------------------------------------------
+      if (secretsPromise && brokerUrl && secretsVault) {
+        logger.log(dim('\n─────────────────────────────────────────────────────────────────'));
+        logger.log(bold('Waiting for agent to request secrets...'));
+        logger.log(dim(`Broker: ${brokerUrl}`));
+        logger.log(dim('Press Ctrl+C to skip (agent will not receive secrets)'));
+        logger.log(dim('─────────────────────────────────────────────────────────────────\n'));
+
+        // Handle Ctrl+C during secret wait - force exit cleanly
+        const sigintHandler = () => {
+          logger.log(warning('\n\nSkipping secret sharing (Ctrl+C)'));
+          process.exit(0);
+        };
+        process.on('SIGINT', sigintHandler);
+
+        const waitResult = await secretsPromise;
+
+        // Remove handler after secrets are done
+        process.off('SIGINT', sigintHandler);
+
+        if (waitResult.success && waitResult.request) {
+          const request = waitResult.request;
+
+          // Display request info
+          logger.log('');
+          logger.log(successColor('Agent connected and requesting secrets!'));
+          logger.log('');
+          logger.log(`  Agent ID: ${request.agentId}`);
+          logger.log(`  Required: ${request.required.join(', ')}`);
+          if (request.optional?.length) {
+            logger.log(`  Optional: ${request.optional.join(', ')}`);
+          }
+          logger.log('');
+
+          // Prompt for approval (auto-approve with --yes flag)
+          const approved = flags.yes || await confirmPrompt('Share these secrets with the agent?', true);
+
+          if (!approved) {
+            logger.log(warning('\nSecret sharing declined.'));
+            // Notify agent so it can fail immediately instead of timing out
+            await sendRejection({
+              brokerUrl,
+              agentId: request.agentId,
+              reason: 'User declined to share secrets',
+              logger: {
+                log: (msg: string) => logger.log(dim(msg)),
+                error: (msg: string) => logger.error(errorColor(msg)),
+              },
+            });
+          } else {
+            const allRequestedKeys = [
+              ...request.required,
+              ...(request.optional || []),
+            ];
+
+            // Multi-vault: read from each vault source
+            const secrets: Record<string, string> = {};
+            for (const source of secretsSources) {
+              const sourceKeys = [...source.required, ...source.optional]
+                .filter(k => allRequestedKeys.includes(k));
+              if (sourceKeys.length === 0) continue;
+
+              logger.log(dim(`\nReading secrets from vault '${source.vault}'...`));
+              const vaultSecrets = readSecretsFromCli({
+                keys: sourceKeys,
+                vault: source.vault,
+                cwd: projectRoot,
+                onError: (key, error) => {
+                  logger.log(dim(`  Failed to read '${key}' from vault '${source.vault}': ${error}`));
+                },
+              });
+              Object.assign(secrets, vaultSecrets);
+            }
+            const foundKeys = Object.keys(secrets);
+
+            const missingRequired = request.required.filter(
+              (key) => !secrets[key]
+            );
+
+            if (missingRequired.length > 0) {
+              const vaultNames = secretsSources.map(s => s.vault).join(', ');
+              logger.log(warning(`\nMissing required secrets in vault(s) '${vaultNames}': ${missingRequired.join(', ')}`));
+              logger.log(dim(`Use "kadi secret set <key> <value> -v <vault>" to add them.`));
+            } else if (foundKeys.length === 0) {
+              const vaultNames = secretsSources.map(s => s.vault).join(', ');
+              logger.log(warning(`\nNo secrets found in vault(s) '${vaultNames}'.`));
+            } else if (!request.publicKey) {
+              logger.log(warning('\nAgent did not provide public key for encryption.'));
+            } else {
+              logger.log(successColor(`\nSharing ${foundKeys.length} secret(s) with agent (encrypted)...`));
+
+              try {
+                await shareSecrets({
+                  brokerUrl,
+                  agentId: request.agentId,
+                  agentPublicKey: request.publicKey,
+                  secrets,
+                  logger: {
+                    log: (msg: string) => logger.log(dim(msg)),
+                    error: (msg: string) => logger.error(errorColor(msg)),
+                  },
+                });
+
+                logger.log(successColor('Secrets shared successfully!'));
+                logger.log(dim(`  Shared: ${foundKeys.join(', ')}`));
+              } catch (shareErr) {
+                logger.log(warning(`\nFailed to share secrets: ${(shareErr as Error).message}`));
+              }
+            }
+          }
+        } else if (waitResult.timedOut) {
+          logger.log(warning('\nTimeout waiting for agent to request secrets.'));
+        } else if (waitResult.error) {
+          logger.log(warning(`\nSecret handshake failed: ${waitResult.error}`));
+        }
+
+        logger.log('');
+      }
+    }
+
+  } catch (err) {
+    failSpinner(progressSpinner, 'Deployment failed');
+    logger.error(errorColor((err as Error).message));
+
+    if (flags.verbose) {
+      console.error(err);
+    }
+  }
+}
+
+/**
+ * Displays local deployment information
+ *
+ * @param data - Deployment data from deploy-ability
+ */
+function displayLocalDeploymentInfo(data: LocalDeploymentData): void {
+  const separator = '─'.repeat(70);
+
+  console.log('');
+  console.log(successColor('✓ Local Deployment Successful!'));
+  console.log('');
+  console.log(separator);
+  console.log(formatHeader('Deployment Information'));
+  console.log(separator);
+  console.log('');
+
+  console.log(formatKeyValue('Profile', data.profile));
+  console.log(formatKeyValue('Engine', data.engine));
+  console.log(formatKeyValue('Network', data.network));
+  console.log(formatKeyValue('Compose Path', data.composePath));
+  console.log(formatKeyValue('Deployed At', data.deployedAt.toLocaleString()));
+  console.log('');
+
+  console.log(formatHeader('Services'));
+  console.log(separator);
+  console.log('');
+
+  for (const serviceName of data.services) {
+    const containerId = data.containers[serviceName];
+    const endpoint = data.endpoints[serviceName];
+
+    console.log(formatKeyValue(serviceName, ''));
+    console.log(`  Container: ${containerId}`);
+    if (endpoint) {
+      console.log(`  Endpoint:  ${endpoint}`);
+    }
+  }
+
+  console.log('');
+}
+
+/**
+ * Displays local deployment summary
+ *
+ * @param data - Deployment data from deploy-ability
+ */
+function displayLocalDeploymentSummary(data: LocalDeploymentData): void {
+  console.log('');
+  console.log(successColor(`✓ Deployed ${data.services.length} service(s) locally`));
+
+  for (const serviceName of data.services) {
+    const endpoint = data.endpoints[serviceName];
+    if (endpoint) {
+      console.log(`  ${serviceName}: ${endpoint}`);
+    }
+  }
+
+  console.log('');
+}
+
+/**
+ * Displays dry-run information for local deployment
+ *
+ * @param profileName - Profile name
+ * @param data - Dry-run data from deploy-ability
+ */
+function displayLocalDryRunInfo(profileName: string, data: LocalDryRunData): void {
+  console.log('');
+  console.log(formatHeader('Dry Run - Local Deployment Preview'));
+  console.log(`  ${formatKeyValue('Profile', profileName)}`);
+  console.log(`  ${formatKeyValue('Engine', data.engine)}`);
+  console.log(`  ${formatKeyValue('Services', data.services.join(', '))}`);
+  console.log('');
+  console.log('Generated docker-compose.yml:');
+  console.log('─'.repeat(70));
+  console.log(data.composeFile);
+  console.log('─'.repeat(70));
+  console.log('');
+  console.log(warning('ℹ️  This is a dry run - no containers were started'));
+  console.log('');
+}