vibecarbon 0.1.0

package/src/lib/cloudflare.js

@@ -0,0 +1,447 @@
+/**
+ * Cloudflare API operations
+ * Shared across deploy.js and destroy.js
+ */
+
+import * as p from '@clack/prompts';
+import { fetchWithRetry } from './fetch-retry.js';
+
+// ============================================================================
+// ZONE AND ACCOUNT OPERATIONS
+// ============================================================================
+
+/**
+ * Get all zones in the Cloudflare account
+ *
+ * @param {string} apiToken - Cloudflare API token
+ * @returns {Promise<Array>} - Array of zone objects
+ */
+export async function getZones(apiToken) {
+  const response = await fetchWithRetry('https://api.cloudflare.com/client/v4/zones', {
+    headers: {
+      Authorization: `Bearer ${apiToken}`,
+      'Content-Type': 'application/json',
+    },
+  });
+
+  if (!response.ok) {
+    const error = await response.json();
+    throw new Error(`Cloudflare API error: ${JSON.stringify(error.errors)}`);
+  }
+
+  const data = await response.json();
+  return data.result;
+}
+
+/**
+ * Get the Cloudflare account ID
+ *
+ * @param {string} apiToken - Cloudflare API token
+ * @returns {Promise<string|null>} - Account ID or null if not found
+ */
+export async function getAccountId(apiToken) {
+  const response = await fetchWithRetry('https://api.cloudflare.com/client/v4/accounts', {
+    headers: {
+      Authorization: `Bearer ${apiToken}`,
+      'Content-Type': 'application/json',
+    },
+  });
+
+  const data = await response.json();
+  if (data.result && data.result.length > 0) {
+    return data.result[0].id;
+  }
+  return null;
+}
+
+// ============================================================================
+// DNS RECORD OPERATIONS
+// ============================================================================
+
+/**
+ * Create or update a DNS record
+ *
+ * @param {string} apiToken - Cloudflare API token
+ * @param {string} zoneId - Zone ID
+ * @param {object} config - Record configuration
+ * @param {string} config.type - Record type (A, CNAME, etc.)
+ * @param {string} config.name - Record name
+ * @param {string} config.content - Record content (IP address, etc.)
+ * @param {boolean} [config.proxied=true] - Whether to proxy through Cloudflare
+ * @param {number} [config.ttl=1] - TTL (1 = auto)
+ * @returns {Promise<object>} - API response
+ */
+export async function createDNSRecord(apiToken, zoneId, config) {
+  const { type, name, content, proxied = true, ttl = 1 } = config;
+
+  // Check if record already exists
+  const listResponse = await fetchWithRetry(
+    `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records?type=${type}&name=${name}`,
+    {
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+      },
+    },
+  );
+
+  const listData = await listResponse.json();
+  const existing = listData.result?.find((r) => r.name === name && r.type === type);
+
+  if (existing) {
+    // Update existing record
+    const updateResponse = await fetchWithRetry(
+      `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records/${existing.id}`,
+      {
+        method: 'PATCH',
+        headers: {
+          Authorization: `Bearer ${apiToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ content, proxied, ttl }),
+      },
+    );
+    return updateResponse.json();
+  }
+
+  // Create new record
+  const response = await fetchWithRetry(
+    `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records`,
+    {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ type, name, content, proxied, ttl }),
+    },
+  );
+
+  return response.json();
+}
+
+/**
+ * Delete a DNS record, but only if its target IP belongs to this caller.
+ *
+ * Cloudflare zones can hold multiple A records for the same name (e.g. when
+ * two e2e scenarios share a root domain and each owns a subdomain).
+ * Deleting unconditionally wipes neighbours' records too — the blast-radius
+ * bug observed in the 2026-05-16 matrix where compose-ha's destroy zeroed
+ * compose's `e1.carbonstack.dev` mid-verify.
+ *
+ * Ownership rule: a record is "ours" iff its `content` (the target IP) is
+ * in `ownedIps`. Records pointing elsewhere are preserved with a `skipped`
+ * count. Pass an empty array to refuse all deletes (the safer default when
+ * envConfig has no server IPs to compare against).
+ *
+ * @param {string} apiToken - Cloudflare API token
+ * @param {string} zoneId - Zone ID
+ * @param {string} name - Record name (FQDN)
+ * @param {string[]} ownedIps - IPs that belong to this caller's stack
+ * @param {string} [type='A'] - Record type
+ * @returns {Promise<{deleted: number, skipped: number, total: number, skippedTargets: string[]}>}
+ */
+export async function deleteDNSRecord(apiToken, zoneId, name, ownedIps, type = 'A') {
+  const listResponse = await fetchWithRetry(
+    `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records?type=${type}&name=${name}`,
+    {
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+      },
+    },
+  );
+
+  const listData = await listResponse.json();
+  const records = (listData.result || []).filter((r) => r.name === name && r.type === type);
+  const total = records.length;
+
+  if (total === 0) {
+    return { deleted: 0, skipped: 0, total: 0, skippedTargets: [] };
+  }
+
+  const owned = new Set(ownedIps || []);
+  let deleted = 0;
+  const skippedTargets = [];
+
+  for (const record of records) {
+    if (!owned.has(record.content)) {
+      skippedTargets.push(record.content);
+      continue;
+    }
+    const response = await fetchWithRetry(
+      `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records/${record.id}`,
+      {
+        method: 'DELETE',
+        headers: {
+          Authorization: `Bearer ${apiToken}`,
+          'Content-Type': 'application/json',
+        },
+      },
+    );
+    if (response.ok) deleted++;
+  }
+
+  return { deleted, skipped: skippedTargets.length, total, skippedTargets };
+}
+
+// ============================================================================
+// HEALTH CHECK OPERATIONS
+// ============================================================================
+
+/**
+ * Create a health check
+ *
+ * @param {string} apiToken - Cloudflare API token
+ * @param {string} zoneId - Zone ID
+ * @param {object} config - Health check configuration
+ * @returns {Promise<object>} - API response
+ */
+export async function createHealthCheck(apiToken, zoneId, config) {
+  const { name, address, path = '/api/health', port = 443 } = config;
+
+  const response = await fetchWithRetry(
+    `https://api.cloudflare.com/client/v4/zones/${zoneId}/healthchecks`,
+    {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        name,
+        address,
+        type: 'HTTPS',
+        port,
+        method: 'GET',
+        path,
+        interval: 60,
+        timeout: 5,
+        retries: 2,
+        consecutive_fails: 2,
+        consecutive_successes: 1,
+      }),
+    },
+  );
+
+  return response.json();
+}
+
+/**
+ * Delete a health check
+ *
+ * @param {string} apiToken - Cloudflare API token
+ * @param {string} zoneId - Zone ID
+ * @param {string} name - Health check name
+ * @returns {Promise<boolean>} - True if deleted
+ */
+export async function deleteHealthCheck(apiToken, zoneId, name) {
+  // List health checks
+  const listResponse = await fetchWithRetry(
+    `https://api.cloudflare.com/client/v4/zones/${zoneId}/healthchecks`,
+    {
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+      },
+    },
+  );
+
+  const listData = await listResponse.json();
+  const healthCheck = listData.result?.find((h) => h.name === name);
+
+  if (!healthCheck) return false;
+
+  const response = await fetchWithRetry(
+    `https://api.cloudflare.com/client/v4/zones/${zoneId}/healthchecks/${healthCheck.id}`,
+    {
+      method: 'DELETE',
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+      },
+    },
+  );
+
+  return response.ok;
+}
+
+// ============================================================================
+// HIGH-LEVEL SETUP FUNCTIONS
+// ============================================================================
+
+/**
+ * Set up Cloudflare for HA deployment with DNS records and health checks
+ *
+ * @param {string} apiToken - Cloudflare API token
+ * @param {string} zoneId - Zone ID
+ * @param {string} domain - Domain name
+ * @param {Array} servers - Array of server objects with name and ip
+ * @returns {Promise<object>} - Setup result
+ */
+export async function setupHA(apiToken, zoneId, domain, servers) {
+  const s = p.spinner();
+
+  try {
+    // Create A record pointing to primary server.
+    //
+    // proxied: false (gray cloud, DNS-only). Was `true` (orange cloud)
+    // back when we used Cloudflare Load Balancers for automatic
+    // failover — the proxy was load-bearing because LB rules ran at
+    // CF's edge. Cloudflare LBs were removed 2026-03-26 in favor of
+    // manual failover (rewriting this A record on demand), so the
+    // proxy is no longer needed and is actively harmful: with orange
+    // cloud, CF intercepts the apex and serves a 404 from its edge
+    // until it can verify the origin's cert and a route exists. The
+    // wildcard below was already gray-cloud — apex matches it now so
+    // both are direct-to-origin via Traefik + Let's Encrypt.
+    // RCA: k8s-ha 2026-04-30 deploy probe got 404 for 1200s — DNS
+    // resolved fine, but CF proxy returned 404 instead of forwarding.
+    s.start(`Creating DNS record for ${domain}`);
+    await createDNSRecord(apiToken, zoneId, {
+      type: 'A',
+      name: domain,
+      content: servers[0].ip,
+      proxied: false,
+    });
+    s.stop('Primary DNS record created');
+
+    // Create wildcard A record for subdomains (registry, api, etc.)
+    // DNS-only (not proxied) — Traefik handles TLS via Let's Encrypt
+    await createDNSRecord(apiToken, zoneId, {
+      type: 'A',
+      name: `*.${domain}`,
+      content: servers[0].ip,
+      proxied: false,
+    });
+
+    // Create health checks for monitoring both regions
+    for (const server of servers) {
+      s.start(`Creating health check for ${server.name}`);
+      await createHealthCheck(apiToken, zoneId, {
+        name: `${server.name}-health`,
+        address: server.ip,
+        path: '/api/health',
+      });
+      s.stop(`Health check created for ${server.name}`);
+    }
+
+    return {
+      success: true,
+      mode: 'dns',
+      primaryIp: servers[0].ip,
+      standbyIp: servers[1]?.ip,
+    };
+  } catch (error) {
+    s.stop(`Cloudflare DNS setup failed: ${error.message}`);
+    return { success: false, error: error.message };
+  }
+}
+
+/**
+ * Set up Cloudflare for simple single-server deployment
+ *
+ * @param {string} apiToken - Cloudflare API token
+ * @param {string} zoneId - Zone ID
+ * @param {string} domain - Domain name
+ * @param {string} serverIp - Server IP address
+ * @returns {Promise<object>} - Setup result
+ */
+/**
+ * Set the zone-level SSL mode on Cloudflare. Used when we want Cloudflare's
+ * edge to terminate TLS (so the origin can skip ACME / cert-manager).
+ *
+ *   - 'off' — no encryption (don't use in prod)
+ *   - 'flexible' — CF↔browser HTTPS, CF↔origin HTTP (allows origin to run
+ *     without any TLS; not recommended — redirect loops with origin-side
+ *     HTTPS)
+ *   - 'full' — CF↔browser HTTPS, CF↔origin HTTPS with ANY cert (self-signed
+ *     OK). Our sweet spot when the user opts into the TLS-proxy path.
+ *   - 'strict' — CF↔origin HTTPS with a valid cert. Requires real ACME,
+ *     defeats the purpose of TLS proxy.
+ *
+ * @param {string} apiToken
+ * @param {string} zoneId
+ * @param {'off'|'flexible'|'full'|'strict'} mode
+ */
+export async function setZoneSslMode(apiToken, zoneId, mode) {
+  const response = await fetchWithRetry(
+    `https://api.cloudflare.com/client/v4/zones/${zoneId}/settings/ssl`,
+    {
+      method: 'PATCH',
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ value: mode }),
+    },
+  );
+  const data = await response.json();
+  if (!data.success) {
+    throw new Error(
+      `Cloudflare zone SSL mode update failed: ${JSON.stringify(data.errors ?? data)}`,
+    );
+  }
+  return data.result;
+}
+
+export async function setupSimple(apiToken, zoneId, domain, serverIp, options = {}) {
+  // proxied default flipped to false (DNS-only / gray-cloud) on
+  // 2026-04-26 after e2e run #3 surfaced the orange-cloud
+  // chicken-and-egg: with proxied=true, dig resolves to CF edge IPs
+  // (172.67.x / 104.21.x), not the origin floating IP. CF then
+  // intercepts HTTPS, terminates with its Universal SSL cert, and
+  // tries to talk to origin per the zone's SSL mode (default Full
+  // (strict) for new zones — requires a valid origin cert). Origin's
+  // cert-manager can't issue via HTTP-01 because LE follows CF's
+  // Always-Use-HTTPS redirect and gets rejected at origin since cert
+  // isn't issued yet. Loop. With proxied=false, dig resolves to the
+  // origin IP directly, LE HTTP-01 hits origin on :80, traefik serves
+  // the challenge, cert issues, HTTPS works. Callers that want CF's
+  // edge TLS can opt in via options.proxied=true (they're then
+  // responsible for setting the zone SSL mode + ensuring origin
+  // accepts CF's challenge path).
+  const { proxied = false, onProgress } = options;
+  // When caller provides onProgress, skip internal spinners (caller manages UI)
+  const s = onProgress ? null : p.spinner();
+
+  try {
+    // Create A record for main domain
+    s?.start(`Creating DNS records for ${domain}`);
+    onProgress?.(`Creating DNS records for ${domain}`);
+    const result = await createDNSRecord(apiToken, zoneId, {
+      type: 'A',
+      name: domain,
+      content: serverIp,
+      proxied,
+    });
+
+    // Create wildcard A record for all subdomains (api, registry, etc.)
+    // DNS-only (not proxied) — Cloudflare free/pro plans don't proxy wildcards,
+    // and Traefik handles TLS via Let's Encrypt anyway.
+    await createDNSRecord(apiToken, zoneId, {
+      type: 'A',
+      name: `*.${domain}`,
+      content: serverIp,
+      proxied: false,
+    });
+    s?.stop('DNS records created (root + wildcard)');
+    onProgress?.('DNS records created (root + wildcard)');
+
+    // Create health check (informational, doesn't affect routing without LB)
+    s?.start('Creating health check');
+    onProgress?.('Creating health check');
+    await createHealthCheck(apiToken, zoneId, {
+      name: `${domain}-health`,
+      address: serverIp,
+      path: '/api/health',
+    });
+    s?.stop('Health check created');
+    onProgress?.('Health check created');
+
+    return { success: true, mode: 'simple', record: result.result };
+  } catch (error) {
+    s?.stop(`Cloudflare setup failed: ${error.message}`);
+    return { success: false, error: error.message };
+  }
+}

package/src/lib/colors.js

@@ -0,0 +1,52 @@
+/**
+ * Shared ANSI color codes and formatting utilities for CLI output
+ */
+
+// ANSI escape codes
+export const colors = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  dim: '\x1b[2m',
+  red: '\x1b[31m',
+  brightRed: '\x1b[91m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  cyan: '\x1b[36m',
+};
+
+// Color formatting helpers
+export const c = {
+  error: (s) => `${colors.red}${s}${colors.reset}`,
+  success: (s) => `${colors.green}${s}${colors.reset}`,
+  warning: (s) => `${colors.yellow}${s}${colors.reset}`,
+  info: (s) => `${colors.cyan}${s}${colors.reset}`,
+  bold: (s) => `${colors.bold}${s}${colors.reset}`,
+  dim: (s) => `${colors.dim}${s}${colors.reset}`,
+  // Bright red + bold — for prominent destruction-warning headlines
+  // (destroy preview banner, "WARNING: data will be lost" footer). More
+  // vibrant than `c.error` (which stays as the muted bullet color).
+  danger: (s) => `${colors.bold}${colors.brightRed}${s}${colors.reset}`,
+  // Composite styles
+  boldCyan: (s) => `${colors.bold}${colors.cyan}${s}${colors.reset}`,
+  boldYellow: (s) => `${colors.bold}${colors.yellow}${s}${colors.reset}`,
+  boldCyanUnderline: (s) => `${colors.bold}${colors.cyan}\x1b[4m${s}${colors.reset}`,
+};
+
+// Branded banner for CLI commands
+export function printBanner() {
+  const bgCyan = '\x1b[46m';
+  const border = 2;
+  const inner = 44;
+  const width = inner + border * 2;
+  const full = `${bgCyan}${' '.repeat(width)}${colors.reset}`;
+  const side = `${bgCyan}${' '.repeat(border)}${colors.reset}`;
+  const empty = `${side}${' '.repeat(inner)}${side}`;
+  const text = '        v  i  b  e  c  a  r  b  o  n        ';
+  console.log();
+  console.log(full);
+  console.log(empty);
+  console.log(`${side}${colors.bold}${colors.cyan}${text}${colors.reset}${side}`);
+  console.log(empty);
+  console.log(full);
+  console.log();
+}