openship 0.1.1 → 0.1.8

package/packages/adapters/src/runtime/deploy-pipeline.ts

@@ -1,146 +0,0 @@
-/**
- * Shared deploy pipeline — activate → deactivate old → route.
- *
- * Mirrors build-pipeline.ts: the pipeline defines the SEQUENCE,
- * each runtime provides a DeployEnvironment that implements the steps.
- *
- * The pipeline is composed in the service layer from existing runtime
- * and routing adapter methods — no changes to the RuntimeAdapter interface.
- *
- *   - preflight:        (optional) validate prerequisites before committing
- *   - activate:         runtime.deploy()  → start container/workload/process
- *   - deactivate:       runtime.stop()    → stop previous deployment
- *   - resolveTargetUrl: runtime.getContainerIp() → internal URL for routing
- *   - routing:          routing.registerRoute()   → reverse-proxy config
- *
- * Cloud:       activate handles expose (URL returned), no resolveTargetUrl.
- * Self-hosted: activate creates container, resolveTargetUrl + routing wire Traefik.
- */
-
-import type { DeployConfig, LogCallback, RouteConfig } from "../types";
-import type { BuildLogger } from "./build-pipeline";
-
-// ─── Deploy environment abstraction ─────────────────────────────────────────
-
-export interface DeployEnvironment {
-  /**
-   * Optional pre-deploy validation — fail fast before committing resources.
-   *
-   * Examples:
-   *   - Self-hosted Docker: is the Docker daemon reachable?
-   *   - Self-hosted Bare: is the target server accessible via SSH?
-   *   - Routing: is nginx/traefik/caddy installed and running?
-   *   - Cloud: does the account have capacity / valid credentials?
-   *
-   * Throw to abort with a descriptive error message.
-   */
-  preflight?(config: DeployConfig): Promise<void>;
-
-  /** Spin up the new deployment (container / workload / process). */
-  activate(config: DeployConfig, onLog: LogCallback): Promise<{ containerId: string; url?: string }>;
-
-  /** Destroy a previous deployment (release slug, domain, resources). */
-  deactivate(containerId: string): Promise<void>;
-
-  /**
-   * Resolve the internal target URL for reverse-proxy routing.
-   *
-   * Return null if the container has no routable IP (e.g. not ready yet).
-   * Omit entirely when routing is handled by activate() (cloud expose).
-   */
-  resolveTargetUrl?(containerId: string, port: number): Promise<string | null>;
-}
-
-// ─── Routing abstraction (subset of RoutingProvider) ────────────────────────
-
-export interface DeployRouting {
-  registerRoute(route: RouteConfig): Promise<void>;
-}
-
-// ─── Pipeline input / output ────────────────────────────────────────────────
-
-export interface DeployPipelineInput {
-  config: DeployConfig;
-  /** Container ID of the currently-active deployment (to deactivate). */
-  previousContainerId?: string;
-  /** Verified domains that need routing. */
-  domains: Array<{ hostname: string; tls: boolean }>;
-  /** Routing provider — omit when routing is handled by the runtime (cloud). */
-  routing?: DeployRouting;
-}
-
-export interface DeployPipelineResult {
-  status: "ready" | "failed";
-  containerId?: string;
-  url?: string;
-  error?: string;
-}
-
-// ─── Pipeline ────────────────────────────────────────────────────────────────
-
-/**
- * Run the deploy pipeline: preflight → activate → deactivate old → route.
- *
- * Called by the service layer after a successful build. The service
- * composes the DeployEnvironment from the RuntimeAdapter's existing
- * methods, so no changes to the adapter interface are needed.
- *
- * Step events ("deploy" running/completed/failed) are owned by this
- * pipeline, just as build-pipeline owns clone/install/build events.
- */
-export async function runDeployPipeline(
-  env: DeployEnvironment,
-  input: DeployPipelineInput,
-  logger: BuildLogger,
-): Promise<DeployPipelineResult> {
-  const { config, previousContainerId, domains, routing } = input;
-
-  try {
-    logger.step("deploy", "running", "Deploying...");
-
-    // ── Pre-deploy validation ────────────────────────────────────────
-    if (env.preflight) {
-      await env.preflight(config);
-    }
-
-    // ── Step 1: Destroy previous deployment (release slug/domain) ──────
-    if (previousContainerId) {
-      await env.deactivate(previousContainerId).catch(() => {});
-    }
-
-    // ── Step 2: Activate new deployment ──────────────────────────────
-    const onLog: LogCallback = (entry) => logger.log(entry.message, entry.level);
-    const { containerId, url } = await env.activate(config, onLog);
-
-    if (!containerId) {
-      throw new Error("Deploy completed but no container was created");
-    }
-
-    // ── Step 3: Register routes ──────────────────────────────────────
-    if (routing && env.resolveTargetUrl && domains.length > 0) {
-      const targetUrl = await env.resolveTargetUrl(containerId, config.port);
-
-      if (targetUrl) {
-        for (const d of domains) {
-          await routing
-            .registerRoute({ domain: d.hostname, targetUrl, tls: d.tls })
-            .catch((err) => {
-              console.error(
-                `[DEPLOY] Failed to register route for ${d.hostname}:`,
-                err,
-              );
-            });
-        }
-      }
-    }
-
-    logger.step("deploy", "completed", "Deployed successfully");
-
-    return { status: "ready", containerId, url };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    logger.step("deploy", "failed", `Deploy failed: ${msg}`);
-    logger.log(`\x1b[1;31mDeploy failed: ${msg}\x1b[0m\n`, "error");
-    return { status: "failed", error: msg };
-  }
-}

package/packages/adapters/src/runtime/docker.ts

@@ -1,443 +0,0 @@
-/**
- * Docker runtime — manages containers via the Docker Engine API (dockerode).
- *
- * Supports three connection modes:
- *   - Local socket (default, zero config)
- *   - Remote via SSH (key auth, built-in ssh2)
- *   - Remote via TCP + mutual TLS
- *
- * This is ONLY the runtime. Routing (Traefik) and SSL (ACME) are separate
- * infrastructure providers — see `infra/`.
- *
- * SECURITY MODEL:
- *   - SSH: key-based auth ONLY. Password auth is deliberately not supported.
- *   - SSH keys should be encrypted at rest and decrypted in memory only.
- *   - Host fingerprints can be pinned via `hostVerifier` (TOFU or strict).
- *   - TCP: mutual TLS (client cert + CA) — no plaintext TCP.
- */
-
-import Dockerode from "dockerode";
-
-import type {
-  BuildConfig,
-  DeployConfig,
-  BuildResult,
-  DeploymentResult,
-  LogEntry,
-  LogCallback,
-  ContainerInfo,
-  ResourceUsage,
-} from "../types";
-
-import type { RuntimeAdapter, RuntimeCapability } from "./types";
-import { BuildLogger } from "./build-pipeline";
-
-// ─── Connection config ───────────────────────────────────────────────────────
-
-export interface DockerConnectionOptions {
-  /** Transport type */
-  transport: "socket" | "ssh" | "tcp";
-
-  /** Host for SSH / TCP transports */
-  host?: string;
-  /** Port (SSH default 22, TCP default 2376) */
-  port?: number;
-
-  /** SSH username (key auth only — no password) */
-  username?: string;
-  /**
-   * Decrypted SSH private key (PEM string).
-   * Should be the in-memory decrypted key, never read from disk.
-   */
-  privateKey?: string;
-  /** Passphrase for the SSH private key (if the key itself is encrypted) */
-  privateKeyPassphrase?: string;
-  /** SSH agent socket path (alternative to privateKey) */
-  sshAgent?: string;
-  /**
-   * Custom host key verifier for SSH connections.
-   * Return `true` to accept, `false` to reject.
-   */
-  hostVerifier?: (hostKey: Buffer) => boolean;
-
-  /** TLS CA certificate (for TCP transport) */
-  ca?: string | Buffer;
-  /** TLS client certificate (for TCP transport) */
-  cert?: string | Buffer;
-  /** TLS client key (for TCP transport) */
-  key?: string | Buffer;
-
-  /** Docker API request timeout in ms (default: 30 000) */
-  timeout?: number;
-}
-
-/** Build a Dockerode options object from our connection config */
-function toDockerodeOptions(opts?: DockerConnectionOptions): Dockerode.DockerOptions {
-  if (!opts || opts.transport === "socket") {
-    return { socketPath: "/var/run/docker.sock" };
-  }
-
-  if (opts.transport === "ssh") {
-    if (!opts.privateKey && !opts.sshAgent) {
-      throw new Error(
-        "SSH transport requires either a privateKey or sshAgent. " +
-          "Password authentication is not supported for security reasons.",
-      );
-    }
-
-    return {
-      protocol: "ssh",
-      host: opts.host,
-      port: opts.port ?? 22,
-      username: opts.username,
-      sshOptions: {
-        privateKey: opts.privateKey,
-        passphrase: opts.privateKeyPassphrase,
-        agent: opts.sshAgent,
-        tryKeyboard: false,
-        hostVerifier: opts.hostVerifier
-          ? (key: Buffer) => opts.hostVerifier!(key)
-          : undefined,
-      },
-      timeout: opts.timeout ?? 30_000,
-    };
-  }
-
-  // TCP + mutual TLS
-  if (!opts.ca || !opts.cert || !opts.key) {
-    throw new Error(
-      "TCP transport requires ca, cert, and key for mutual TLS. " +
-        "Plaintext TCP connections are not supported for security reasons.",
-    );
-  }
-
-  return {
-    protocol: "https",
-    host: opts.host,
-    port: opts.port ?? 2376,
-    ca: opts.ca as string | undefined,
-    cert: opts.cert as string | undefined,
-    key: opts.key as string | undefined,
-    timeout: opts.timeout ?? 30_000,
-  };
-}
-
-// ─── Docker runtime ──────────────────────────────────────────────────────────
-
-export class DockerRuntime implements RuntimeAdapter {
-  readonly name = "docker";
-  readonly capabilities: ReadonlySet<RuntimeCapability> = new Set<RuntimeCapability>([
-    "build",
-    "deploy",
-    "stop",
-    "start",
-    "restart",
-    "destroy",
-    "containerInfo",
-    "runtimeLogs",
-    "streamLogs",
-    "usage",
-    "containerIp",
-  ]);
-
-  /** Underlying dockerode instance — exposed for advanced usage */
-  readonly docker: Dockerode;
-  /** Connection config this runtime was created with */
-  readonly connectionOptions?: DockerConnectionOptions;
-
-  constructor(opts?: DockerConnectionOptions) {
-    this.connectionOptions = opts;
-    this.docker = new Dockerode(toDockerodeOptions(opts));
-  }
-
-  supports(cap: RuntimeCapability): boolean {
-    return this.capabilities.has(cap);
-  }
-
-  async dispose(): Promise<void> {
-    // dockerode handles connection cleanup internally via ssh2 / modem
-  }
-
-  // ─── Health check ──────────────────────────────────────────────────
-
-  /** Ping the Docker daemon — useful for connection testing */
-  async ping(): Promise<boolean> {
-    try {
-      await this.docker.ping();
-      return true;
-    } catch {
-      return false;
-    }
-  }
-
-  /** Get Docker daemon info (version, platform, etc.) */
-  async info(): Promise<Record<string, unknown>> {
-    return this.docker.info();
-  }
-
-  // ── Build lifecycle ────────────────────────────────────────────────────
-
-  async build(config: BuildConfig, logger?: BuildLogger): Promise<BuildResult> {
-    // TODO: Build implementation using:
-    //   1. Clone repo into temp dir or use `docker.buildImage()` with tar context
-    //   2. Stream build output via logger
-    //   3. Tag the resulting image
-    const log = logger ?? new BuildLogger();
-    log.log("Build queued");
-    return { sessionId: config.sessionId, status: "queued" };
-  }
-
-  async cancelBuild(sessionId: string): Promise<void> {
-    // TODO: Kill the build container by session label
-    void sessionId;
-  }
-
-  async getBuildLogs(sessionId: string): Promise<LogEntry[]> {
-    void sessionId;
-    return [];
-  }
-
-  // ── Deploy lifecycle ───────────────────────────────────────────────────
-
-  async deploy(config: DeployConfig, _onLog?: LogCallback): Promise<DeploymentResult> {
-    // TODO: Create and start a container using:
-    //   this.docker.createContainer({ Image, Env, HostConfig, Labels, ... })
-    //   container.start()
-    return { deploymentId: config.deploymentId, status: "queued" };
-  }
-
-  async stop(containerId: string): Promise<void> {
-    const container = this.docker.getContainer(containerId);
-    await container.stop();
-  }
-
-  async start(containerId: string): Promise<void> {
-    const container = this.docker.getContainer(containerId);
-    await container.start();
-  }
-
-  async restart(containerId: string): Promise<void> {
-    const container = this.docker.getContainer(containerId);
-    await container.restart();
-  }
-
-  async destroy(containerId: string): Promise<void> {
-    const container = this.docker.getContainer(containerId);
-    await container.remove({ force: true });
-  }
-
-  // ── Observability ──────────────────────────────────────────────────────
-
-  async getContainerInfo(containerId: string): Promise<ContainerInfo> {
-    const container = this.docker.getContainer(containerId);
-    const data = await container.inspect();
-
-    const statusMap: Record<string, ContainerInfo["status"]> = {
-      running: "running",
-      exited: "stopped",
-      paused: "stopped",
-      restarting: "running",
-      dead: "failed",
-      created: "stopped",
-    };
-
-    const startedAt = data.State.StartedAt;
-    const uptimeSeconds = startedAt && data.State.Running
-      ? Math.floor((Date.now() - new Date(startedAt).getTime()) / 1000)
-      : undefined;
-
-    let hostPort: number | undefined;
-    for (const bindings of Object.values(data.NetworkSettings.Ports ?? {})) {
-      if (bindings?.[0]?.HostPort) {
-        hostPort = parseInt(bindings[0].HostPort, 10);
-        break;
-      }
-    }
-
-    let ip: string | undefined;
-    for (const net of Object.values(data.NetworkSettings.Networks ?? {})) {
-      if (net.IPAddress) {
-        ip = net.IPAddress;
-        break;
-      }
-    }
-
-    return {
-      containerId,
-      status: statusMap[data.State.Status] ?? "stopped",
-      ip,
-      hostPort,
-      uptimeSeconds: uptimeSeconds && uptimeSeconds > 0 ? uptimeSeconds : undefined,
-    };
-  }
-
-  async getRuntimeLogs(containerId: string, tail?: number): Promise<LogEntry[]> {
-    const container = this.docker.getContainer(containerId);
-    const buffer = await container.logs({
-      stdout: true,
-      stderr: true,
-      timestamps: true,
-      tail: tail ?? 200,
-    });
-
-    // Docker multiplexed streams prepend 8-byte frame headers per line.
-    // Strip them before parsing text.
-    const stripHeaders = (buf: Buffer): string => {
-      const lines: string[] = [];
-      let offset = 0;
-      while (offset < buf.length) {
-        if (offset + 8 <= buf.length &&
-            (buf[offset] === 1 || buf[offset] === 2) &&
-            buf[offset + 1] === 0 && buf[offset + 2] === 0 && buf[offset + 3] === 0) {
-          const size = buf.readUInt32BE(offset + 4);
-          lines.push(buf.subarray(offset + 8, offset + 8 + size).toString("utf-8"));
-          offset += 8 + size;
-        } else {
-          // No header — treat rest as raw text
-          lines.push(buf.subarray(offset).toString("utf-8"));
-          break;
-        }
-      }
-      return lines.join("");
-    };
-
-    const raw = stripHeaders(buffer);
-
-    return raw
-      .split("\n")
-      .filter(Boolean)
-      .map((line) => {
-        const spaceIdx = line.indexOf(" ");
-        const timestamp = spaceIdx > 0 ? line.slice(0, spaceIdx) : new Date().toISOString();
-        const message = spaceIdx > 0 ? line.slice(spaceIdx + 1) : line;
-
-        const level = /\b(error|fatal|panic)\b/i.test(message)
-          ? "error" as const
-          : /\bwarn(ing)?\b/i.test(message)
-            ? "warn" as const
-            : "info" as const;
-
-        return { timestamp, message, level };
-      });
-  }
-
-  async streamRuntimeLogs(
-    containerId: string,
-    onLog: LogCallback,
-    opts?: { tail?: number },
-  ): Promise<() => void> {
-    const container = this.docker.getContainer(containerId);
-    const stream = await container.logs({
-      stdout: true,
-      stderr: true,
-      timestamps: true,
-      follow: true,
-      tail: opts?.tail ?? 100,
-    }) as unknown as NodeJS.ReadableStream;
-
-    let destroyed = false;
-
-    const parseLevel = (msg: string) =>
-      /\b(error|fatal|panic)\b/i.test(msg)
-        ? "error" as const
-        : /\bwarn(ing)?\b/i.test(msg)
-          ? "warn" as const
-          : "info" as const;
-
-    // Docker multiplexed streams prepend an 8-byte frame header per chunk
-    // when both stdout and stderr are attached. Strip it before parsing.
-    const stripDockerHeader = (chunk: Buffer): Buffer => {
-      // Header format: [stream_type(1), 0, 0, 0, size(4 big-endian)]
-      // stream_type: 1 = stdout, 2 = stderr
-      if (chunk.length >= 8 && (chunk[0] === 1 || chunk[0] === 2) &&
-          chunk[1] === 0 && chunk[2] === 0 && chunk[3] === 0) {
-        return chunk.subarray(8);
-      }
-      return chunk;
-    };
-
-    let buffer = "";
-    stream.on("data", (chunk: Buffer) => {
-      if (destroyed) return;
-      buffer += stripDockerHeader(chunk).toString("utf-8");
-      const lines = buffer.split("\n");
-      buffer = lines.pop() ?? "";
-      for (const line of lines) {
-        if (!line) continue;
-        const spaceIdx = line.indexOf(" ");
-        const timestamp = spaceIdx > 0 ? line.slice(0, spaceIdx) : new Date().toISOString();
-        const message = spaceIdx > 0 ? line.slice(spaceIdx + 1) : line;
-        onLog({ timestamp, message, level: parseLevel(message) });
-      }
-    });
-
-    stream.on("end", () => {
-      if (buffer && !destroyed) {
-        onLog({ timestamp: new Date().toISOString(), message: buffer, level: parseLevel(buffer) });
-        buffer = "";
-      }
-    });
-
-    return () => {
-      if (!destroyed) {
-        destroyed = true;
-        // Destroy the follow stream to stop Docker from sending more data
-        if ("destroy" in stream && typeof (stream as any).destroy === "function") {
-          (stream as any).destroy();
-        }
-      }
-    };
-  }
-
-  async getUsage(containerId: string): Promise<ResourceUsage> {
-    const container = this.docker.getContainer(containerId);
-    const stats = await container.stats({ stream: false });
-
-    const cpuDelta =
-      stats.cpu_stats.cpu_usage.total_usage - stats.precpu_stats.cpu_usage.total_usage;
-    const systemDelta =
-      stats.cpu_stats.system_cpu_usage - stats.precpu_stats.system_cpu_usage;
-    const numCpus = stats.cpu_stats.online_cpus || 1;
-    const cpuPercent =
-      systemDelta > 0 ? (cpuDelta / systemDelta) * numCpus * 100 : 0;
-
-    const memoryMb = (stats.memory_stats.usage ?? 0) / (1024 * 1024);
-
-    let networkRxBytes = 0;
-    let networkTxBytes = 0;
-    if (stats.networks) {
-      for (const iface of Object.values(stats.networks)) {
-        networkRxBytes += iface.rx_bytes ?? 0;
-        networkTxBytes += iface.tx_bytes ?? 0;
-      }
-    }
-
-    let diskBytes = 0;
-    if (stats.blkio_stats?.io_service_bytes_recursive) {
-      for (const entry of stats.blkio_stats.io_service_bytes_recursive) {
-        diskBytes += entry.value ?? 0;
-      }
-    }
-    const diskMb = diskBytes / (1024 * 1024);
-
-    return {
-      cpuPercent: Math.round(cpuPercent * 100) / 100,
-      memoryMb: Math.round(memoryMb * 100) / 100,
-      diskMb: Math.round(diskMb * 100) / 100,
-      networkRxBytes,
-      networkTxBytes,
-    };
-  }
-
-  // ── Network ────────────────────────────────────────────────────────────
-
-  async getContainerIp(containerId: string): Promise<string | null> {
-    const container = this.docker.getContainer(containerId);
-    const data = await container.inspect();
-
-    for (const net of Object.values(data.NetworkSettings.Networks ?? {})) {
-      if (net.IPAddress) return net.IPAddress;
-    }
-    return null;
-  }
-}

package/packages/adapters/src/runtime/index.ts

@@ -1,69 +0,0 @@
-/**
- * Runtime layer barrel exports.
- *
- * Use `createRuntime()` for lazy-loaded runtime resolution (preferred).
- * Import classes directly only when you know the mode at import time.
- */
-
-// ─── Types ───────────────────────────────────────────────────────────────────
-export type { RuntimeAdapter, RuntimeCapability } from "./types";
-export { assertCapability } from "./types";
-export { runBuildPipeline, BuildLogger, type BuildEnvironment } from "./build-pipeline";
-
-// ─── Runtime classes ─────────────────────────────────────────────────────────
-export { DockerRuntime, type DockerConnectionOptions } from "./docker";
-export { BareRuntime, type BareRuntimeOptions } from "./bare";
-export { CloudRuntime } from "./cloud";
-
-// ─── Factory ─────────────────────────────────────────────────────────────────
-
-import type { RuntimeAdapter } from "./types";
-import type { DockerConnectionOptions } from "./docker";
-import type { BareRuntimeOptions } from "./bare";
-
-export type RuntimeMode = "docker" | "bare" | "cloud";
-
-export interface CreateRuntimeOptions {
-  mode: RuntimeMode;
-  /** Docker connection config (only used when mode="docker") */
-  docker?: DockerConnectionOptions;
-  /** Bare runtime config (only used when mode="bare") */
-  bare?: BareRuntimeOptions;
-  /** Oblien client ID (cloud — master creds) */
-  cloudClientId?: string;
-  /** Oblien client secret (cloud — master creds) */
-  cloudClientSecret?: string;
-  /** Oblien namespace-scoped token (cloud — local instances) */
-  cloudToken?: string;
-}
-
-/**
- * Create a runtime adapter — async with lazy imports.
- *
- * ZERO BLEED GUARANTEE:
- *   Docker-related code (dockerode, ssh2) is only imported when mode="docker".
- *   "cloud" and "bare" modes never load those dependencies.
- */
-export async function createRuntime(opts: CreateRuntimeOptions): Promise<RuntimeAdapter> {
-  switch (opts.mode) {
-    case "docker": {
-      const { DockerRuntime } = await import("./docker");
-      return new DockerRuntime(opts.docker);
-    }
-    case "bare": {
-      const { BareRuntime } = await import("./bare");
-      return new BareRuntime(opts.bare);
-    }
-    case "cloud": {
-      const { Oblien } = await import("oblien");
-      const { CloudRuntime } = await import("./cloud");
-      const client = opts.cloudToken
-        ? new Oblien({ token: opts.cloudToken })
-        : new Oblien({
-            clientId: opts.cloudClientId ?? process.env.OBLIEN_CLIENT_ID ?? "",
-            clientSecret: opts.cloudClientSecret ?? process.env.OBLIEN_CLIENT_SECRET ?? "",
-          });
-      return new CloudRuntime(client);
-    }
-  }
-}