vibecarbon 0.1.0

package/src/lib/deploy/state.js

@@ -0,0 +1,120 @@
+/**
+ * Task-Level Deployment State Tracker
+ * Manages persistence and hashing of deployment steps to enable granular resume.
+ */
+
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+export class StateTracker {
+  constructor(projectName, environment) {
+    this.projectName = projectName;
+    this.environment = environment;
+    this.stateDir = join(process.cwd(), '.vibecarbon');
+    this.stateFile = join(this.stateDir, `deploy-state-${environment}.json`);
+    this.state = this.load();
+  }
+
+  /**
+   * Load state from disk
+   */
+  load() {
+    if (existsSync(this.stateFile)) {
+      try {
+        return JSON.parse(readFileSync(this.stateFile, 'utf-8'));
+      } catch {
+        return { steps: {} };
+      }
+    }
+    return { steps: {} };
+  }
+
+  /**
+   * Save state to disk
+   */
+  save() {
+    if (!existsSync(this.stateDir)) {
+      mkdirSync(this.stateDir, { recursive: true });
+    }
+    writeFileSync(this.stateFile, JSON.stringify(this.state, null, 2));
+  }
+
+  /**
+   * Calculate a hash for a step's inputs
+   * @param {object} inputs
+   * @returns {string}
+   */
+  calculateHash(inputs) {
+    const data = JSON.stringify(inputs);
+    return createHash('sha256').update(data).digest('hex');
+  }
+
+  /**
+   * Check if a step should be skipped based on its input hash
+   * @param {string} stepId
+   * @param {object} inputs
+   * @returns {boolean}
+   */
+  shouldSkip(stepId, inputs) {
+    const currentHash = this.calculateHash(inputs);
+    const stepState = this.state.steps[stepId];
+
+    if (stepState && stepState.status === 'completed' && stepState.hash === currentHash) {
+      return true;
+    }
+    return false;
+  }
+
+  /**
+   * Record a step as started
+   * @param {string} stepId
+   * @param {object} inputs
+   */
+  startStep(stepId, inputs) {
+    const hash = this.calculateHash(inputs);
+    this.state.steps[stepId] = {
+      status: 'started',
+      hash,
+      startedAt: new Date().toISOString(),
+    };
+    this.save();
+  }
+
+  /**
+   * Record a step as completed
+   * @param {string} stepId
+   * @param {object} result
+   */
+  completeStep(stepId, result = {}) {
+    if (!this.state.steps[stepId]) {
+      throw new Error(`Step ${stepId} was not started`);
+    }
+    this.state.steps[stepId].status = 'completed';
+    this.state.steps[stepId].completedAt = new Date().toISOString();
+    this.state.steps[stepId].result = result;
+    this.save();
+  }
+
+  /**
+   * Get the result of a completed step
+   * @param {string} stepId
+   * @returns {object|null}
+   */
+  getStepResult(stepId) {
+    const stepState = this.state.steps[stepId];
+    return stepState && stepState.status === 'completed' ? stepState.result : null;
+  }
+
+  /**
+   * Clear state for a new deployment
+   */
+  clear() {
+    this.state = { steps: {} };
+    if (existsSync(this.stateFile)) {
+      try {
+        writeFileSync(this.stateFile, JSON.stringify(this.state, null, 2));
+      } catch {}
+    }
+  }
+}

package/src/lib/deploy/utils.js

@@ -0,0 +1,328 @@
+/**
+ * Deployment Utilities
+ * Shared helper functions for all deployment modes
+ */
+
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { runCommand } from '../command.js';
+import { getProviderClass } from '../providers/index.js';
+import { escapeDotenv } from '../shell.js';
+
+// Deployment Defaults
+// Cluster-autoscaler is enabled by default with a static floor of 1 and a
+// bounded ceiling of 3 (CA pool spawns 0..(max-min) workers on top of the
+// static floor). See specs/2026-04-25-k3s-pivot-design.md for the design
+// decision: autoscaling on by default, bounded ceiling to cap blast radius.
+export const DEFAULT_WORKER_MIN = 1;
+export const DEFAULT_WORKER_MAX = 3;
+
+/**
+ * Get provider configuration from registry
+ * @param {string} providerName
+ * @returns {object}
+ */
+export function getProviderConfig(providerName) {
+  const ProviderClass = getProviderClass(providerName);
+  return {
+    name: ProviderClass.NAME,
+    regions: ProviderClass.REGIONS,
+    serverTypes: ProviderClass.SERVER_TYPES,
+    defaultType: ProviderClass.DEFAULT_TYPE,
+    haRegions: ProviderClass.HA_REGIONS,
+  };
+}
+
+/**
+ * Normalize environment name: lowercase, and treat "production" as "prod"
+ * @param {string} envName
+ * @returns {string}
+ */
+export function normalizeEnvName(envName) {
+  const normalized = envName.toLowerCase();
+  return normalized === 'production' ? 'prod' : normalized;
+}
+
+/**
+ * Branch naming: environment name = branch name, except prod uses main
+ * @param {string} envName
+ * @returns {string}
+ */
+export function getBranchName(envName) {
+  return envName === 'prod' ? 'main' : envName;
+}
+
+/**
+ * Merge env overrides into the remote .env file by pulling it down,
+ * updating in-memory, and SCPing it back.
+ *
+ * @param {string} host - remote host IP
+ * @param {string} sshOpts - space-separated SSH options string
+ * @param {string} remoteDir - absolute path to the remote deployment directory
+ * @param {Record<string, string>} updates - key/value pairs to set in .env
+ */
+export function mergeRemoteDotenv(host, sshOpts, remoteDir, updates) {
+  const dir = mkdtempSync(join(tmpdir(), 'vibecarbon-envmerge-'));
+  const local = join(dir, '.env');
+  try {
+    // Pull remote .env
+    try {
+      runCommand(['scp', ...sshOpts.split(' '), `root@${host}:${remoteDir}/.env`, local], {
+        silent: true,
+      });
+    } catch (e) {
+      throw new Error(
+        `Failed to pull ${remoteDir}/.env from ${host} — is the remote file present and SSH reachable? Underlying error: ${e?.message ?? e}`,
+      );
+    }
+    const existing = readFileSync(local, 'utf-8').split('\n');
+    const seen = new Set();
+    const merged = existing.map((line) => {
+      const m = line.match(/^([A-Z_][A-Z0-9_]*)=/);
+      if (m && updates[m[1]] !== undefined) {
+        seen.add(m[1]);
+        return `${m[1]}=${escapeDotenv(updates[m[1]])}`;
+      }
+      return line;
+    });
+    for (const [k, v] of Object.entries(updates)) {
+      if (!seen.has(k)) merged.push(`${k}=${escapeDotenv(v)}`);
+    }
+    writeFileSync(local, merged.join('\n'));
+    // Push merged .env back
+    try {
+      runCommand(['scp', ...sshOpts.split(' '), local, `root@${host}:${remoteDir}/.env`], {
+        silent: true,
+      });
+    } catch (e) {
+      throw new Error(
+        `Failed to push merged .env back to ${host}:${remoteDir}/.env — remote still has the previous contents. Underlying error: ${e?.message ?? e}`,
+      );
+    }
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Generate SSH key pair for deployment
+ * @param {string} keyPath
+ * @returns {string} public key content
+ */
+export function generateSSHKeyPair(keyPath) {
+  if (!existsSync(keyPath)) {
+    // Ensure parent directory exists
+    const keyDir = dirname(keyPath);
+    if (!existsSync(keyDir)) {
+      mkdirSync(keyDir, { recursive: true });
+    }
+    runCommand(
+      ['ssh-keygen', '-t', 'ed25519', '-f', keyPath, '-N', '', '-C', 'vibecarbon-deploy'],
+      {
+        silent: true,
+      },
+    );
+  }
+  // Ensure correct permissions for SSH
+  chmodSync(keyPath, 0o600);
+  chmodSync(`${keyPath}.pub`, 0o644);
+  return readFileSync(`${keyPath}.pub`, 'utf-8').trim();
+}
+
+/**
+ * Wait for SSH to become available on a host
+ * @param {string} host
+ * @param {string} sshKeyPath
+ * @param {number} maxAttempts
+ * @returns {Promise<boolean>}
+ */
+export async function waitForSSH(host, sshKeyPath, maxAttempts = 30) {
+  const sshOpts = `-i "${sshKeyPath}" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes`;
+  for (let i = 0; i < maxAttempts; i++) {
+    try {
+      runCommand(
+        ['ssh', ...sshOpts.split(' '), '-o', 'ConnectTimeout=5', `root@${host}`, 'echo', 'ok'],
+        {
+          stdio: 'pipe',
+          timeout: 10000,
+        },
+      );
+      return true;
+    } catch {
+      await new Promise((r) => setTimeout(r, 5000));
+    }
+  }
+  return false;
+}
+
+/**
+ * Initial server setup - copy project files needed for docker compose
+ * @param {string} host - remote host IP
+ * @param {string} sshKeyPath - path to the SSH private key
+ * @param {string} projectName - name of the project
+ * @param {object} options - setup options (observability, n8n, etc.)
+ */
+export async function setupServerFiles(host, sshKeyPath, projectName, options = {}) {
+  const cwd = process.cwd();
+  const remoteDir = `/opt/${projectName}`;
+  const sshOpts = `-i "${sshKeyPath}" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes`;
+
+  // Create remote directory and required subdirectories
+  runCommand(
+    [
+      'ssh',
+      ...sshOpts.split(' '),
+      `root@${host}`,
+      'mkdir',
+      '-p',
+      `${remoteDir}/volumes/db`,
+      `${remoteDir}/volumes/kong`,
+      `${remoteDir}/supabase/migrations`,
+    ],
+    { stdio: 'pipe' },
+  );
+
+  // List of files to copy
+  const filesToCopy = [
+    'docker-compose.yml',
+    'docker-compose.prod.yml',
+    'Dockerfile',
+    '.dockerignore',
+  ];
+
+  // Add optional service compose files if enabled
+  if (options.observability) {
+    filesToCopy.push('docker-compose.observability.yml', 'docker-compose.observability.prod.yml');
+  }
+  if (options.n8n) {
+    filesToCopy.push('docker-compose.n8n.yml', 'docker-compose.n8n.prod.yml');
+  }
+  if (options.metabase) {
+    filesToCopy.push('docker-compose.metabase.yml', 'docker-compose.metabase.prod.yml');
+  }
+
+  // Copy each file that exists
+  for (const file of filesToCopy) {
+    const localPath = join(cwd, file);
+    if (existsSync(localPath)) {
+      runCommand(['scp', ...sshOpts.split(' '), localPath, `root@${host}:${remoteDir}/`], {
+        stdio: 'pipe',
+      });
+    }
+  }
+
+  // Copy all volumes/db init files (SQL + shell scripts)
+  const volumesDbDir = join(cwd, 'volumes', 'db');
+  if (existsSync(volumesDbDir)) {
+    for (const file of readdirSync(volumesDbDir)) {
+      const filePath = join(volumesDbDir, file);
+      if (existsSync(filePath)) {
+        runCommand(
+          ['scp', ...sshOpts.split(' '), filePath, `root@${host}:${remoteDir}/volumes/db/`],
+          {
+            stdio: 'pipe',
+          },
+        );
+      }
+    }
+  }
+
+  // Copy supabase migrations directory
+  const migrationsDir = join(cwd, 'supabase', 'migrations');
+  if (existsSync(migrationsDir)) {
+    runCommand(
+      [
+        'scp',
+        ...sshOpts.split(' '),
+        '-r',
+        `${migrationsDir}/*`,
+        `root@${host}:${remoteDir}/supabase/migrations/`,
+      ],
+      {
+        stdio: 'pipe',
+        ignoreError: true, // handle the 2>/dev/null || true semantics
+      },
+    );
+  }
+
+  // Copy kong configuration
+  const volumesKongDir = join(cwd, 'volumes', 'kong');
+  if (existsSync(volumesKongDir)) {
+    for (const file of readdirSync(volumesKongDir)) {
+      const filePath = join(volumesKongDir, file);
+      if (existsSync(filePath)) {
+        runCommand(
+          ['scp', ...sshOpts.split(' '), filePath, `root@${host}:${remoteDir}/volumes/kong/`],
+          {
+            stdio: 'pipe',
+          },
+        );
+      }
+    }
+  }
+
+  // Copy local .env file if it exists
+  const localEnvPath = join(cwd, '.env');
+  if (existsSync(localEnvPath)) {
+    runCommand(['scp', ...sshOpts.split(' '), localEnvPath, `root@${host}:${remoteDir}/`], {
+      stdio: 'pipe',
+    });
+  }
+
+  // Override/append production env vars
+  const envOverrides = {};
+  if (options.githubRepo && options.envName) {
+    envOverrides.APP_IMAGE = `ghcr.io/${options.githubRepo}:${options.envName}`;
+  }
+  if (options.domain) {
+    envOverrides.DOMAIN = options.domain;
+    envOverrides.ACME_EMAIL = `admin@${options.domain}`;
+    envOverrides.SITE_URL = `https://api.${options.domain}`;
+    envOverrides.SUPABASE_URL = 'http://kong:8000';
+  }
+
+  if (Object.keys(envOverrides).length > 0) {
+    mergeRemoteDotenv(host, sshOpts, remoteDir, envOverrides);
+  }
+
+  // Copy prometheus config
+  const prometheusDir = join(cwd, 'prometheus');
+  if (options.observability && existsSync(prometheusDir)) {
+    runCommand(
+      ['ssh', ...sshOpts.split(' '), `root@${host}`, 'mkdir', '-p', `${remoteDir}/prometheus`],
+      { stdio: 'pipe' },
+    );
+    runCommand(
+      [
+        'scp',
+        ...sshOpts.split(' '),
+        '-r',
+        `${prometheusDir}/*`,
+        `root@${host}:${remoteDir}/prometheus/`,
+      ],
+      {
+        stdio: 'pipe',
+      },
+    );
+  }
+
+  // Copy grafana provisioning
+  const grafanaDir = join(cwd, 'grafana');
+  if (options.observability && existsSync(grafanaDir)) {
+    runCommand(['scp', ...sshOpts.split(' '), '-r', grafanaDir, `root@${host}:${remoteDir}/`], {
+      stdio: 'pipe',
+    });
+  }
+
+  return true;
+}

package/src/lib/deploy-logger.js

@@ -0,0 +1,93 @@
+/**
+ * Persistent deploy logger.
+ *
+ * Tees every byte written to process.stdout / process.stderr during a
+ * deploy invocation into ~/.vibecarbon/logs/<env>-<ts>.log. Survives
+ * cluster teardown and process exit so a failed deploy can be reviewed
+ * after the fact — including the long-running Pulumi/k3s/Flux output
+ * that's otherwise lost when a session ends.
+ *
+ * ANSI escape sequences (color, cursor moves, spinner frames) are
+ * stripped from the file so it's grep-able and reads cleanly in
+ * `less`/editors. The terminal still gets the original colored output.
+ */
+
+import { createWriteStream, existsSync, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+// Strip ANSI CSI sequences (ESC + `[` + params + final byte) and bare CRs.
+// Built from String.fromCharCode to avoid biome's no-control-characters lint
+// rejecting a literal escape in the regex; equivalent to
+// `/\x1b\[[0-9;?]*[a-zA-Z]|\r/g`.
+const ANSI_RE = new RegExp(`${String.fromCharCode(0x1b)}\\[[0-9;?]*[a-zA-Z]|\\r`, 'g');
+
+/**
+ * Wrap an async function so all stdout/stderr during its run is also
+ * tee'd to ~/.vibecarbon/logs/<envName>-<timestamp>.log. Returns
+ * whatever the wrapped function returns; rethrows after restoring.
+ *
+ * The returned promise resolves only after the underlying file stream
+ * has flushed and closed, so the caller can safely read the log file
+ * back as soon as the call settles.
+ *
+ * @param {string} envName  Environment name for the log filename
+ *                          (defaults to "deploy" if missing).
+ * @param {() => Promise<any>} fn  Async work to run.
+ * @returns {Promise<{result: any, logPath: string}>}
+ */
+export async function withDeployLog(envName, fn) {
+  const logDir = join(homedir(), '.vibecarbon', 'logs');
+  if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
+  const ts = new Date().toISOString().replace(/[:.]/g, '-');
+  const safeEnv = (envName || 'deploy').replace(/[^a-zA-Z0-9_-]/g, '_');
+  const logPath = join(logDir, `${safeEnv}-${ts}.log`);
+  const stream = createWriteStream(logPath, { flags: 'a' });
+
+  const originalStdoutWrite = process.stdout.write.bind(process.stdout);
+  const originalStderrWrite = process.stderr.write.bind(process.stderr);
+
+  const tee = (orig) => (chunk, encoding, cb) => {
+    try {
+      const s = typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString();
+      stream.write(s.replace(ANSI_RE, ''));
+    } catch {
+      // best-effort — never break terminal output for the sake of logging
+    }
+    return orig(chunk, encoding, cb);
+  };
+
+  process.stdout.write = tee(originalStdoutWrite);
+  process.stderr.write = tee(originalStderrWrite);
+
+  // Header so the file is self-describing.
+  stream.write(
+    `# vibecarbon deploy log\n# env: ${envName ?? '(unset)'}\n# started: ${new Date().toISOString()}\n# argv: ${process.argv.join(' ')}\n\n`,
+  );
+
+  // Wait for the underlying fd to actually close before resolving so
+  // callers can read the file immediately after the await.
+  const closeStream = () =>
+    new Promise((resolve) => {
+      stream.on('close', resolve);
+      stream.end();
+    });
+
+  const restore = async () => {
+    process.stdout.write = originalStdoutWrite;
+    process.stderr.write = originalStderrWrite;
+    await closeStream();
+  };
+
+  try {
+    const result = await fn();
+    await restore();
+    return { result, logPath };
+  } catch (err) {
+    try {
+      stream.write(`\n# deploy threw: ${err instanceof Error ? err.stack || err.message : err}\n`);
+    } catch {}
+    await restore();
+    throw err;
+  }
+}

package/src/lib/dns-propagation.js

@@ -0,0 +1,48 @@
+/**
+ * Wait for a DNS A record to propagate to public resolvers.
+ *
+ * Polls Cloudflare (1.1.1.1) and Google (8.8.8.8) resolvers until at least
+ * one returns the expected IP, or the timeout elapses. Returns true on
+ * success, false if the budget runs out (caller decides whether to proceed
+ * or hard-fail).
+ *
+ * Why this matters for compose deploys: Traefik attempts ACME HTTP-01
+ * challenges immediately on container start and bursts ~7 attempts in
+ * ~30s. Let's Encrypt rejects challenges with "no valid A records found"
+ * if its own resolver sees stale or absent records (the 0.0.0.0 warm-up
+ * placeholder also fails this check — LE treats 0.0.0.0 as not-a-valid-
+ * A-record). Once Traefik gives up, acme.json has zero certs and the
+ * browser sees the TRAEFIK DEFAULT CERT, which is self-signed and shows
+ * NET::ERR_CERT_AUTHORITY_INVALID. Cold-deploy 2026-05-19 RCA against
+ * vibecarbon.com hit exactly this.
+ *
+ * The fix: gate compose-up on DNS propagation so Traefik's first ACME
+ * attempt sees real records. Polling public resolvers is the closest
+ * approximation we have to "LE will see this" without actually calling
+ * LE's resolver directly.
+ *
+ * @param {string} domain - The hostname to check (e.g. "vibecarbon.com")
+ * @param {string} expectedIp - The IP we expect the record to point to
+ * @param {number} [timeoutMs=120_000] - Total budget in ms
+ * @returns {Promise<boolean>} true if propagated, false if timed out
+ */
+export async function waitForDNSPropagation(domain, expectedIp, timeoutMs = 120_000) {
+  const dns = await import('node:dns');
+  const resolver = new dns.promises.Resolver();
+  resolver.setServers(['1.1.1.1', '8.8.8.8']);
+
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const addrs = await resolver.resolve4(domain);
+      if (addrs.includes(expectedIp)) return true;
+    } catch {
+      // NXDOMAIN / SERVFAIL / timeout — record may not exist yet or
+      // hasn't propagated to this resolver. Retry; cheap to fail.
+    }
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    await new Promise((r) => setTimeout(r, Math.min(5_000, remaining)));
+  }
+  return false;
+}

package/src/lib/environment.js

@@ -0,0 +1,58 @@
+/**
+ * Shared environment resolution
+ * Used by backup.js, restore.js, and failover.js
+ */
+
+import * as p from '@clack/prompts';
+import { c } from './colors.js';
+
+/**
+ * Resolve which environment the user wants to operate on.
+ * - If `args.env` is set, validates it against config
+ * - If only one environment exists, selects it automatically
+ * - Otherwise, prompts the user to pick one
+ *
+ * @param {{ env: string | null }} args - Parsed CLI arguments
+ * @param {object} projectConfig - Project configuration with environments
+ * @returns {Promise<{ envName: string, envConfig: object }>}
+ */
+export async function resolveEnvironment(args, projectConfig) {
+  const envNames = Object.keys(projectConfig.environments || {});
+
+  if (envNames.length === 0) {
+    p.log.error('No deployed environments found');
+    p.log.info(`Run ${c.info('vibecarbon deploy')} first`);
+    process.exit(1);
+  }
+
+  let envName = args.env;
+
+  if (!envName) {
+    if (envNames.length === 1) {
+      envName = envNames[0];
+    } else {
+      envName = await p.select({
+        message: 'Which environment?',
+        options: envNames.map((name) => ({
+          value: name,
+          label: name,
+          hint: projectConfig.environments[name].servers?.map((s) => s.ip).join(', '),
+        })),
+      });
+    }
+  }
+
+  if (p.isCancel(envName)) {
+    p.cancel('Operation cancelled.');
+    process.exit(0);
+  }
+
+  const envConfig = projectConfig.environments[envName];
+  if (!envConfig) {
+    p.log.error(`Environment '${envName}' not found`);
+    p.log.info(`Available environments: ${envNames.join(', ')}`);
+    process.exit(1);
+  }
+
+  return { envName, envConfig };
+}