vibecarbon 0.1.0

package/src/lib/backup-s3.js

@@ -0,0 +1,179 @@
+/**
+ * Shared S3 backup helpers
+ * Used by backup.js, restore.js, and compose backup cron
+ */
+
+import { createReadStream, createWriteStream, statSync } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
+
+/**
+ * Create an S3 client from config.
+ */
+export async function getS3Client(s3Config) {
+  const { S3Client } = await import('@aws-sdk/client-s3');
+  return new S3Client({
+    region: s3Config.region,
+    endpoint: s3Config.endpoint,
+    forcePathStyle: true,
+    credentials: {
+      accessKeyId: s3Config.accessKey,
+      secretAccessKey: s3Config.secretKey,
+    },
+  });
+}
+
+/**
+ * List full backup archives in S3, sorted newest-first.
+ */
+export async function listS3Backups(s3Config) {
+  const { ListObjectsV2Command } = await import('@aws-sdk/client-s3');
+  const client = await getS3Client(s3Config);
+
+  const command = new ListObjectsV2Command({
+    Bucket: s3Config.bucket,
+    Prefix: 'backups/',
+  });
+
+  const response = await client.send(command);
+  const objects = response.Contents || [];
+
+  return objects
+    .filter((obj) => obj.Key.endsWith('_full.tar.gz'))
+    .sort((a, b) => b.LastModified - a.LastModified)
+    .map((obj) => ({
+      name: obj.Key.replace('backups/', ''),
+      key: obj.Key,
+      size: formatBytes(obj.Size),
+      date: obj.LastModified.toISOString().replace('T', ' ').slice(0, 19),
+    }));
+}
+
+/**
+ * Download a backup from S3 to a local file.
+ *
+ * Retries transient/non-auth errors up to 3x — symmetric with uploadS3Backup.
+ * Same Hetzner S3 fast-failure modes (DNS blips, TCP RST, momentary 5xx) hit
+ * downloads too; surfaced in k8s e2e fanout4b 2026-05-01 e3 restore
+ * which failed in 881ms then succeeded on a manual retry against the same rig.
+ */
+export async function downloadS3Backup(s3Config, key, localPath) {
+  const { GetObjectCommand } = await import('@aws-sdk/client-s3');
+  const client = await getS3Client(s3Config);
+
+  const terminal = new Set([
+    'InvalidAccessKeyId',
+    'SignatureDoesNotMatch',
+    'AccessDenied',
+    'NoSuchKey',
+  ]);
+  const maxAttempts = 3;
+  let lastErr;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      const command = new GetObjectCommand({
+        Bucket: s3Config.bucket,
+        Key: key,
+      });
+      const response = await client.send(command);
+      const writeStream = createWriteStream(localPath);
+      await pipeline(response.Body, writeStream);
+      return;
+    } catch (err) {
+      lastErr = err;
+      if (terminal.has(err.name)) break;
+      if (attempt < maxAttempts) {
+        await new Promise((r) => setTimeout(r, 1500 * attempt));
+      }
+    }
+  }
+  throw lastErr;
+}
+
+/**
+ * Upload a local backup file to S3.
+ */
+export async function uploadS3Backup(s3Config, localPath, s3Key) {
+  const { PutObjectCommand } = await import('@aws-sdk/client-s3');
+  const client = await getS3Client(s3Config);
+
+  const { size } = statSync(localPath);
+
+  // Retry transient/non-auth errors up to 3x. Fast-failures in the 500ms
+  // range (Hetzner S3 DNS blips, momentary 5xx, TCP RST during stream)
+  // cleanly recover on retry. Known-terminal auth errors
+  // (InvalidAccessKeyId / SignatureDoesNotMatch / AccessDenied) short-
+  // circuit so a real misconfig doesn't wait out the retry budget.
+  const terminal = new Set(['InvalidAccessKeyId', 'SignatureDoesNotMatch', 'AccessDenied']);
+  const maxAttempts = 3;
+  let lastErr;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    // Fresh stream per attempt — AWS SDK consumes the body, can't rewind.
+    const fileStream = createReadStream(localPath);
+    const command = new PutObjectCommand({
+      Bucket: s3Config.bucket,
+      Key: s3Key,
+      Body: fileStream,
+      ContentLength: size,
+    });
+    try {
+      await client.send(command);
+      return s3Key;
+    } catch (err) {
+      lastErr = err;
+      // Per-attempt diagnostic. Without this, a successful retry leaves no
+      // breadcrumb of the failed attempt — and a fully-failed upload only
+      // gets logged by the caller (src/backup.js) with the LAST error,
+      // hiding whether all attempts saw the same SDK error or different
+      // ones. Goes to stderr so e2e/CI capture it.
+      console.error(
+        `[backup-s3] upload attempt ${attempt}/${maxAttempts} failed — name=${err.name} code=${err.Code ?? err.code ?? 'n/a'} status=${err.$metadata?.httpStatusCode ?? 'n/a'} bucket=${s3Config.bucket} endpoint=${s3Config.endpoint} region=${s3Config.region}`,
+      );
+      if (terminal.has(err.name)) break;
+      if (attempt < maxAttempts) {
+        await new Promise((r) => setTimeout(r, 1500 * attempt));
+      }
+    }
+  }
+  throw lastErr;
+}
+
+/**
+ * Delete expired backups from S3 based on retention policy.
+ * Parses dates from filenames: {project}_{YYYYMMDD}_{HHMMSS}_full.tar.gz
+ */
+export async function deleteExpiredS3Backups(s3Config, projectName, retentionDays) {
+  const { DeleteObjectCommand, ListObjectsV2Command } = await import('@aws-sdk/client-s3');
+  const client = await getS3Client(s3Config);
+
+  const command = new ListObjectsV2Command({
+    Bucket: s3Config.bucket,
+    Prefix: `backups/${projectName}_`,
+  });
+
+  const response = await client.send(command);
+  const objects = response.Contents || [];
+
+  const cutoffDate = new Date();
+  cutoffDate.setDate(cutoffDate.getDate() - retentionDays);
+  const cutoffStr = cutoffDate.toISOString().slice(0, 10).replace(/-/g, '');
+
+  let deleted = 0;
+  for (const obj of objects) {
+    const match = obj.Key.match(/_(\d{8})_\d{6}_full\.tar\.gz$/);
+    if (match && match[1] < cutoffStr) {
+      await client.send(new DeleteObjectCommand({ Bucket: s3Config.bucket, Key: obj.Key }));
+      deleted++;
+    }
+  }
+  return deleted;
+}
+
+/**
+ * Format a byte count as a human-readable string.
+ */
+export function formatBytes(bytes) {
+  if (bytes === 0) return '0 B';
+  const units = ['B', 'KB', 'MB', 'GB'];
+  const i = Math.floor(Math.log(bytes) / Math.log(1024));
+  return `${(bytes / 1024 ** i).toFixed(1)} ${units[i]}`;
+}

package/src/lib/build.js

@@ -0,0 +1,33 @@
+/**
+ * Shared registry credential helpers.
+ *
+ * Before Lever 1 this module also housed `buildOnRemote`, `buildAndPush`, and
+ * `updateK8sDeployment` — all of which orchestrated a per-deploy SSH-and-docker
+ * build flow. That flow is gone: images are built in CI (GitHub Actions) and
+ * published to ghcr.io. See `ci-setup.js` for the new flow.
+ *
+ * What remains here: small helpers for reading ghcr.io credentials from `gh`.
+ */
+
+import { runCommand } from './command.js';
+
+/**
+ * Get GitHub Container Registry credentials using gh auth.
+ * @returns {Promise<{ username: string, token: string }>}
+ */
+export async function getGHCRCredentials() {
+  try {
+    const token = runCommand('gh auth token', { silent: true })?.trim();
+    const username = runCommand('gh api user -q .login', { silent: true })?.trim();
+
+    if (!token || !username) {
+      throw new Error('Could not get GitHub credentials');
+    }
+
+    return { username, token };
+  } catch (error) {
+    throw new Error(
+      `Failed to get GitHub credentials. Run 'gh auth login' first.\n${error.message}`,
+    );
+  }
+}

package/src/lib/checksum.js

@@ -0,0 +1,28 @@
+/**
+ * Checksum utilities for file integrity tracking
+ */
+
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+
+/**
+ * Compute SHA-256 hash of a string
+ *
+ * @param {string} content - Content to hash
+ * @returns {string} - Hash in "sha256:<hex>" format
+ */
+export function hashContent(content) {
+  const hex = createHash('sha256').update(content).digest('hex');
+  return `sha256:${hex}`;
+}
+
+/**
+ * Compute SHA-256 hash of a file's contents
+ *
+ * @param {string} filePath - Absolute path to file
+ * @returns {string} - Hash in "sha256:<hex>" format
+ */
+export function hashFile(filePath) {
+  const content = readFileSync(filePath, 'utf-8');
+  return hashContent(content);
+}