takos-control 1.0.0

package/src/application/services/deployment/group-deploy-types.ts

@@ -0,0 +1,116 @@
+/**
+ * Type definitions for group deploy — deploying an entire app.yml manifest
+ * as a unit directly to Cloudflare, bypassing the store install flow.
+ */
+import type { AppManifest } from './group-deploy-manifest.js';
+
+// ── Options ──────────────────────────────────────────────────────────────────
+
+export interface GroupDeployOptions {
+  /** Parsed app.yml manifest */
+  manifest: AppManifest;
+  /** Target environment (staging, production) */
+  env: string;
+  /** Dispatch namespace name (omit for account top-level) */
+  namespace?: string;
+  /** Group name override (defaults to manifest.metadata.name) */
+  groupName?: string;
+  /** Cloudflare account ID */
+  accountId: string;
+  /** Cloudflare API token */
+  apiToken: string;
+  /** dry-run: show plan without deploying */
+  dryRun?: boolean;
+  /** Compatibility date for workers (defaults to 2025-01-01) */
+  compatibilityDate?: string;
+}
+
+// ── Results ──────────────────────────────────────────────────────────────────
+
+export type ServiceDeployStatus = 'deployed' | 'failed' | 'skipped';
+export type ResourceProvisionStatus = 'provisioned' | 'exists' | 'failed';
+export type BindingStatus = 'bound' | 'failed';
+
+export interface ServiceDeployResult {
+  name: string;
+  type: 'worker' | 'container' | 'http';
+  status: ServiceDeployStatus;
+  scriptName?: string;
+  url?: string;
+  error?: string;
+}
+
+export interface ResourceProvisionResult {
+  name: string;
+  type: string;
+  status: ResourceProvisionStatus;
+  id?: string;
+  error?: string;
+}
+
+export interface BindingResult {
+  from: string;
+  to: string;
+  type: string;
+  status: BindingStatus;
+  error?: string;
+}
+
+export interface GroupDeployResult {
+  groupName: string;
+  env: string;
+  namespace?: string;
+  dryRun: boolean;
+  services: ServiceDeployResult[];
+  resources: ResourceProvisionResult[];
+  bindings: BindingResult[];
+}
+
+// ── Provisioned resource tracking ────────────────────────────────────────────
+
+export interface ProvisionedResource {
+  name: string;
+  type: string;
+  id: string;
+  binding: string;
+}
+
+// ── Wrangler config ──────────────────────────────────────────────────────────
+
+export interface WranglerD1Binding {
+  binding: string;
+  database_name: string;
+  database_id: string;
+}
+
+export interface WranglerR2Binding {
+  binding: string;
+  bucket_name: string;
+}
+
+export interface WranglerKVBinding {
+  binding: string;
+  id: string;
+}
+
+export interface WranglerServiceBinding {
+  binding: string;
+  service: string;
+}
+
+export interface WranglerVars {
+  [key: string]: string;
+}
+
+export interface WranglerConfig {
+  name: string;
+  main: string;
+  compatibility_date: string;
+  compatibility_flags?: string[];
+  vars?: WranglerVars;
+  d1_databases?: WranglerD1Binding[];
+  r2_buckets?: WranglerR2Binding[];
+  kv_namespaces?: WranglerKVBinding[];
+  services?: WranglerServiceBinding[];
+  dispatch_namespace?: string;
+}

package/src/application/services/deployment/group-deploy.ts

@@ -0,0 +1,349 @@
+/**
+ * Group Deploy Orchestrator.
+ *
+ * Deploys an entire app.yml manifest as a group — provisions resources,
+ * deploys worker services via wrangler, and wires up service bindings.
+ *
+ * This bypasses the Takos store install flow and deploys directly to
+ * Cloudflare infrastructure using the Cloudflare API and wrangler CLI.
+ *
+ * Usage:
+ *   const result = await deployGroup({ manifest, env: 'staging', ... });
+ */
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import type { AppManifest, WorkerService } from './group-deploy-manifest.js';
+import type {
+  GroupDeployOptions,
+  GroupDeployResult,
+  ServiceDeployResult,
+  BindingResult,
+  ProvisionedResource,
+} from './group-deploy-types.js';
+import { provisionResources } from './resource-provisioner.js';
+import {
+  generateWranglerConfig,
+  serializeWranglerToml,
+} from './wrangler-config-gen.js';
+import { CloudflareApiClient } from '../cloudflare/api-client.js';
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+function execCommand(
+  command: string,
+  args: string[],
+  options?: { cwd?: string; env?: NodeJS.ProcessEnv },
+): Promise<{ stdout: string; stderr: string; exitCode: number }> {
+  return new Promise((resolve) => {
+    execFile(command, args, {
+      cwd: options?.cwd,
+      env: { ...process.env, ...options?.env },
+      maxBuffer: 10 * 1024 * 1024,
+    }, (error, stdout, stderr) => {
+      resolve({
+        stdout: String(stdout || ''),
+        stderr: String(stderr || ''),
+        exitCode: error ? (error as NodeJS.ErrnoException & { code?: number }).code as number || 1 : 0,
+      });
+    });
+  });
+}
+
+async function deployWorkerWithWrangler(
+  tomlContent: string,
+  options: {
+    accountId: string;
+    apiToken: string;
+    namespace?: string;
+    secrets?: Map<string, string>;
+    dryRun?: boolean;
+  },
+): Promise<{ success: boolean; error?: string }> {
+  // Write temporary wrangler.toml
+  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'takos-group-deploy-'));
+  const tomlPath = path.join(tmpDir, 'wrangler.toml');
+  // Create a minimal entry point in case artifactPath is relative
+  const entryPath = path.join(tmpDir, 'index.js');
+
+  try {
+    await fs.writeFile(tomlPath, tomlContent, 'utf8');
+    // Placeholder entry — the real bundle comes from the artifact path in the manifest.
+    // For group-deploy we expect the artifact to be available at the main path.
+    await fs.writeFile(entryPath, 'export default { fetch() { return new Response("ok"); } };', 'utf8');
+
+    if (options.dryRun) {
+      return { success: true };
+    }
+
+    const wranglerEnv: NodeJS.ProcessEnv = {
+      CLOUDFLARE_ACCOUNT_ID: options.accountId,
+      CLOUDFLARE_API_TOKEN: options.apiToken,
+    };
+
+    // Deploy the worker
+    const deployResult = await execCommand(
+      'npx',
+      ['wrangler', 'deploy', '--config', tomlPath],
+      { cwd: tmpDir, env: wranglerEnv },
+    );
+
+    if (deployResult.exitCode !== 0) {
+      return {
+        success: false,
+        error: `wrangler deploy failed: ${deployResult.stderr || deployResult.stdout}`,
+      };
+    }
+
+    // Set secrets if any
+    if (options.secrets && options.secrets.size > 0) {
+      for (const [secretName, secretValue] of options.secrets) {
+        const secretResult = await execCommand(
+          'npx',
+          ['wrangler', 'secret', 'put', secretName, '--config', tomlPath],
+          {
+            cwd: tmpDir,
+            env: {
+              ...wranglerEnv,
+              // wrangler reads stdin for secret value; use echo pipe workaround
+              WRANGLER_SECRET_VALUE: secretValue,
+            },
+          },
+        );
+        if (secretResult.exitCode !== 0) {
+          return {
+            success: false,
+            error: `Failed to set secret ${secretName}: ${secretResult.stderr || secretResult.stdout}`,
+          };
+        }
+      }
+    }
+
+    return { success: true };
+  } finally {
+    // Cleanup temp directory
+    await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => { /* cleanup: best-effort temp dir removal */ });
+  }
+}
+
+// ── Dry-run plan formatter ───────────────────────────────────────────────────
+
+function buildDryRunServiceResult(
+  serviceName: string,
+  service: WorkerService,
+  scriptName: string,
+): ServiceDeployResult {
+  return {
+    name: serviceName,
+    type: 'worker',
+    status: 'deployed',
+    scriptName,
+  };
+}
+
+// ── Main orchestrator ────────────────────────────────────────────────────────
+
+/**
+ * Deploy an app manifest as a group.
+ *
+ * Steps:
+ * 1. Provision resources (D1, R2, KV, secrets)
+ * 2. Deploy each worker service via wrangler
+ * 3. Wire up service bindings
+ * 4. Report results
+ *
+ * Errors in individual services do not abort the entire deployment —
+ * all services are attempted and the result reports each status.
+ */
+export async function deployGroup(options: GroupDeployOptions): Promise<GroupDeployResult> {
+  const {
+    manifest,
+    env,
+    namespace,
+    accountId,
+    apiToken,
+    dryRun = false,
+    compatibilityDate,
+  } = options;
+
+  const groupName = options.groupName || manifest.metadata.name;
+
+  const result: GroupDeployResult = {
+    groupName,
+    env,
+    namespace,
+    dryRun,
+    services: [],
+    resources: [],
+    bindings: [],
+  };
+
+  // ── Step 1: Provision resources ──────────────────────────────────────────
+
+  let client: CloudflareApiClient | null = null;
+  if (!dryRun) {
+    client = new CloudflareApiClient({ accountId, apiToken });
+  }
+
+  const { provisioned, results: resourceResults } = await provisionResources(
+    manifest.spec.resources || {},
+    { accountId, apiToken, groupName, env, dryRun },
+    client,
+  );
+  result.resources = resourceResults;
+
+  // Collect secrets for each service (secretRef resources referenced by bindings)
+  const secretsByService = new Map<string, Map<string, string>>();
+
+  // ── Step 2: Deploy each service ──────────────────────────────────────────
+
+  for (const [workerName, worker] of Object.entries(manifest.spec.workers)) {
+    // Worker service
+    const wranglerConfig = generateWranglerConfig(worker, workerName, {
+      groupName,
+      env,
+      namespace,
+      resources: provisioned,
+      compatibilityDate,
+    });
+
+    if (dryRun) {
+      result.services.push(buildDryRunServiceResult(workerName, worker, wranglerConfig.name));
+
+      // Report bindings that would be created
+      if (worker.bindings?.d1) {
+        for (const resourceName of worker.bindings.d1) {
+          result.bindings.push({
+            from: workerName,
+            to: resourceName,
+            type: 'd1',
+            status: 'bound',
+          });
+        }
+      }
+      if (worker.bindings?.r2) {
+        for (const resourceName of worker.bindings.r2) {
+          result.bindings.push({
+            from: workerName,
+            to: resourceName,
+            type: 'r2',
+            status: 'bound',
+          });
+        }
+      }
+      if (worker.bindings?.kv) {
+        for (const resourceName of worker.bindings.kv) {
+          result.bindings.push({
+            from: workerName,
+            to: resourceName,
+            type: 'kv',
+            status: 'bound',
+          });
+        }
+      }
+      if (worker.bindings?.services) {
+        for (const targetService of worker.bindings.services) {
+          result.bindings.push({
+            from: workerName,
+            to: targetService,
+            type: 'service',
+            status: 'bound',
+          });
+        }
+      }
+      continue;
+    }
+
+    // Collect secrets for this service
+    const serviceSecrets = new Map<string, string>();
+    for (const [resourceName, resource] of provisioned) {
+      if (resource.type === 'secretRef') {
+        // Check if this service references this secret via its bindings
+        // For secretRef, the resource ID holds the generated value
+        serviceSecrets.set(resource.binding, resource.id);
+      }
+    }
+    if (serviceSecrets.size > 0) {
+      secretsByService.set(workerName, serviceSecrets);
+    }
+
+    const toml = serializeWranglerToml(wranglerConfig);
+
+    try {
+      const deployResult = await deployWorkerWithWrangler(toml, {
+        accountId,
+        apiToken,
+        namespace,
+        secrets: serviceSecrets,
+        dryRun: false,
+      });
+
+      if (deployResult.success) {
+        result.services.push({
+          name: workerName,
+          type: 'worker',
+          status: 'deployed',
+          scriptName: wranglerConfig.name,
+        });
+
+        // Record bindings as successful
+        const bindingResults = collectBindingResults(workerName, worker, 'bound');
+        result.bindings.push(...bindingResults);
+      } else {
+        result.services.push({
+          name: workerName,
+          type: 'worker',
+          status: 'failed',
+          scriptName: wranglerConfig.name,
+          error: deployResult.error,
+        });
+
+        const bindingResults = collectBindingResults(workerName, worker, 'failed');
+        result.bindings.push(...bindingResults);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      result.services.push({
+        name: workerName,
+        type: 'worker',
+        status: 'failed',
+        scriptName: wranglerConfig.name,
+        error: message,
+      });
+    }
+  }
+
+  return result;
+}
+
+function collectBindingResults(
+  serviceName: string,
+  service: WorkerService,
+  status: 'bound' | 'failed',
+): BindingResult[] {
+  const results: BindingResult[] = [];
+
+  if (service.bindings?.d1) {
+    for (const resourceName of service.bindings.d1) {
+      results.push({ from: serviceName, to: resourceName, type: 'd1', status });
+    }
+  }
+  if (service.bindings?.r2) {
+    for (const resourceName of service.bindings.r2) {
+      results.push({ from: serviceName, to: resourceName, type: 'r2', status });
+    }
+  }
+  if (service.bindings?.kv) {
+    for (const resourceName of service.bindings.kv) {
+      results.push({ from: serviceName, to: resourceName, type: 'kv', status });
+    }
+  }
+  if (service.bindings?.services) {
+    for (const targetService of service.bindings.services) {
+      results.push({ from: serviceName, to: targetService, type: 'service', status });
+    }
+  }
+
+  return results;
+}

package/src/application/services/deployment/index.ts

@@ -0,0 +1,7 @@
+/**
+ * Deployment service — re-exports from sub-modules for backward compatibility.
+ */
+export { DeploymentService, buildDeploymentArtifactRef } from './service';
+export type { DeploymentEnv } from './service';
+export type { DeployState, Deployment, DeploymentEvent, CreateDeploymentInput, RollbackInput } from './models';
+export { rollbackDeploymentSteps } from './rollback';

package/src/application/services/deployment/models.ts

@@ -0,0 +1,154 @@
+import type { WorkerBinding } from '../../../platform/providers/cloudflare/wfp.ts';
+import type { DbEnv } from '../../../shared/types';
+import type { DurableNamespaceBinding, KvStoreBinding, ObjectStoreBinding } from '../../../shared/types/bindings.ts';
+import type { WfpDeploymentProviderEnv, DeploymentProviderRegistryLike } from './provider';
+
+export type DeploymentEnv = DbEnv & WfpDeploymentProviderEnv & {
+  ENCRYPTION_KEY?: string;
+  ADMIN_DOMAIN: string;
+  WORKER_BUNDLES?: ObjectStoreBinding;
+  OCI_ORCHESTRATOR_URL?: string;
+  OCI_ORCHESTRATOR_TOKEN?: string;
+  HOSTNAME_ROUTING: KvStoreBinding;
+  ROUTING_DO?: DurableNamespaceBinding;
+  ROUTING_DO_PHASE?: string;
+  SERVICE_INTERNAL_JWT_ISSUER?: string;
+  DEPLOYMENT_PROVIDER_REGISTRY?: DeploymentProviderRegistryLike;
+};
+
+export type ArtifactKind = 'worker-bundle' | 'container-image';
+
+export type DeployState =
+  | 'pending'
+  | 'uploading_bundle'
+  | 'creating_resources'
+  | 'deploying_worker'
+  | 'setting_bindings'
+  | 'routing'
+  | 'completed'
+  | 'failed'
+  | 'rolled_back';
+
+export type DeploymentStatus = 'pending' | 'in_progress' | 'success' | 'failed' | 'rolled_back';
+
+export type RoutingStatus = 'active' | 'canary' | 'rollback' | 'archived';
+
+export type DeploymentProviderName = 'workers-dispatch' | 'oci' | 'ecs' | 'cloud-run' | 'k8s';
+
+export type DeploymentProviderRef = {
+  name: DeploymentProviderName;
+};
+
+export type DeploymentTargetEndpoint =
+  | {
+      kind: 'service-ref';
+      ref: string;
+    }
+  | {
+      kind: 'http-url';
+      base_url: string;
+    };
+
+export type DeploymentTargetArtifact = {
+  kind?: ArtifactKind;
+  image_ref?: string;
+  exposed_port?: number;
+  health_path?: string;
+};
+
+export type DeploymentTarget = {
+  route_ref?: string;
+  endpoint?: DeploymentTargetEndpoint;
+  artifact?: DeploymentTargetArtifact;
+};
+
+export interface Deployment {
+  id: string;
+  service_id: string;
+  worker_id?: string;
+  space_id: string;
+  version: number;
+  artifact_ref: string | null;
+  artifact_kind: ArtifactKind;
+  bundle_r2_key: string | null;
+  bundle_hash: string | null;
+  bundle_size: number | null;
+  wasm_r2_key: string | null;
+  wasm_hash: string | null;
+  assets_manifest: string | null;
+  runtime_config_snapshot_json: string;
+  bindings_snapshot_encrypted: string | null;
+  env_vars_snapshot_encrypted: string | null;
+  deploy_state: DeployState;
+  current_step: string | null;
+  step_error: string | null;
+  status: DeploymentStatus;
+  routing_status: RoutingStatus;
+  routing_weight: number;
+  deployed_by: string | null;
+  deploy_message: string | null;
+  provider_name: DeploymentProviderName;
+  target_json: string;
+  provider_state_json: string;
+  idempotency_key: string | null;
+  is_rollback: boolean;
+  rollback_from_version: number | null;
+  rolled_back_at: string | null;
+  rolled_back_by: string | null;
+  started_at: string | null;
+  completed_at: string | null;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface DeploymentEvent {
+  id: number;
+  deployment_id: string;
+  actor_user_id: string | null;
+  event_type: string;
+  step_name: string | null;
+  message: string | null;
+  details: string | null;
+  created_at: string;
+}
+
+export interface CreateDeploymentInput {
+  serviceId?: string;
+  workerId?: string;
+  spaceId: string;
+  userId?: string | null;
+  idempotencyKey?: string | null;
+  artifactKind?: ArtifactKind;
+  bundleContent?: string;
+  wasmContent?: ArrayBuffer | null;
+  deployMessage?: string;
+  strategy?: 'direct' | 'canary';
+  canaryWeight?: number;
+  provider?: DeploymentProviderRef;
+  target?: DeploymentTarget;
+  snapshotOverride?: {
+    envVars: Record<string, string>;
+    bindings: WorkerBinding[];
+    runtimeConfig?: RuntimeConfig;
+  };
+}
+
+export interface McpServerConfig {
+  enabled: boolean;
+  name: string;
+  path: string;
+}
+
+export interface RuntimeConfig {
+  compatibility_date?: string;
+  compatibility_flags?: string[];
+  limits?: { cpu_ms?: number; subrequests?: number };
+  mcp_server?: McpServerConfig;
+}
+
+export interface RollbackInput {
+  serviceId?: string;
+  workerId?: string;
+  targetVersion?: number;
+  userId: string;
+}