vibecarbon 0.1.0

package/src/lib/iac/programs/hetzner-k8s.js

@@ -0,0 +1,320 @@
+/**
+ * Pulumi program for a single Hetzner k3s cluster.
+ *
+ * One call to `buildHetznerK8sProgram(config)` returns a Pulumi inline
+ * program (a function) that declares the cloud resources. The Automation
+ * API wrapper in `../index.js` runs it.
+ *
+ * Resources declared:
+ *   - SshKey (optional — reuse existing by ID for HA)
+ *   - Network + Subnet
+ *   - Firewall
+ *   - Floating IP
+ *   - Master server (cloud-init: master-init.sh)
+ *   - Supabase server (cloud-init: supabase-init.sh)
+ *   - Worker servers × N (cloud-init: worker-init.sh)
+ *   - Placement group for workers (spread)
+ *
+ * Outputs: masterIp, masterPrivateIp, supabaseIp, workerIps, floatingIp,
+ * networkId, sshKeyId, k3sToken.
+ */
+
+import { randomBytes } from 'node:crypto';
+import * as hcloud from '@pulumi/hcloud';
+import * as pulumi from '@pulumi/pulumi';
+import { loadCloudInit, renderScript } from '../cloud-init.js';
+
+/**
+ * @typedef {Object} K8sStackConfig
+ * @property {string} projectName
+ * @property {string} environment      Environment name (used for cluster name + labels)
+ * @property {string} sshPublicKey     OpenSSH-format public key
+ * @property {string} [existingSshKeyId]  If set, skip creating a new SSH key
+ *                                        (HA case: shared key across clusters)
+ * @property {string} [k3sToken]          Pre-shared k3s node-join token
+ *                                        (auto-generated if omitted)
+ * @property {string} location         Hetzner datacenter (nbg1/hel1/fsn1/hil/ash/sin)
+ * @property {string} networkZone      eu-central / us-east / us-west / ap-southeast
+ * @property {string} masterServerType
+ * @property {string} supabaseServerType
+ * @property {string} workerServerType
+ * @property {number} minWorkers   Static floor of worker servers (provisioned by Pulumi). Default 1.
+ * @property {number} maxWorkers   Upper bound for cluster-autoscaler. Not consumed by Pulumi; flows to the CA Deployment in applyK3sManifests. Default 3.
+ * @property {string} k3sVersion
+ * @property {string} privateNetworkRange   Default 10.0.0.0/8
+ * @property {string} subnetRange           Default 10.0.1.0/24
+ * @property {Record<string,string>} labels
+ * @property {string[]} [allowedSshIps]       CIDR list, defaults to 0.0.0.0/0
+ * @property {string[]} [allowedK8sApiIps]    CIDR list, defaults to 0.0.0.0/0
+ * @property {string} apiToken                Hetzner Cloud API token. Baked into
+ *                                            the master cloud-init so the node
+ *                                            can write the `hcloud` and
+ *                                            `hcloud-csi` kube-system Secrets
+ *                                            that hcloud-cloud-controller-manager
+ *                                            and hcloud-csi-driver read on boot.
+ */
+
+/**
+ * Build an inline Pulumi program for the given cluster config.
+ * @param {K8sStackConfig} config
+ * @returns {() => Promise<Record<string, unknown>>}
+ */
+export function buildHetznerK8sProgram(config) {
+  const clusterName = `${config.projectName}-${config.environment}`;
+  const labels = { project: config.projectName, environment: config.environment, ...config.labels };
+  // Operator-IP firewall lock (H-2). The deploy flow populates these from
+  // projectConfig.operatorCidrs; an empty list = nothing can SSH in or hit
+  // the k8s API. We refuse to build a program that would do that — far
+  // better to fail loudly than to silently apply an open `0.0.0.0/0`.
+  if (!config.allowedSshIps?.length) {
+    throw new Error(
+      'allowedSshIps required (no default; pass operatorCidrs from .vibecarbon.json or set ALLOWED_SSH_IPS=...)',
+    );
+  }
+  if (!config.allowedK8sApiIps?.length) {
+    throw new Error(
+      'allowedK8sApiIps required (no default; pass operatorCidrs from .vibecarbon.json or set ALLOWED_SSH_IPS=...)',
+    );
+  }
+  const allowedSshIps = config.allowedSshIps;
+  const allowedK8sApiIps = config.allowedK8sApiIps;
+  const k3sToken = config.k3sToken ?? randomBytes(32).toString('hex');
+  const privateNetworkRange = config.privateNetworkRange ?? '10.0.0.0/8';
+  const subnetRange = config.subnetRange ?? '10.0.1.0/24';
+  const minWorkers = config.minWorkers ?? 1;
+
+  const masterInitTemplate = loadCloudInit('master-init.sh');
+  const supabaseInitTemplate = loadCloudInit('supabase-init.sh');
+  const workerInitTemplate = loadCloudInit('worker-init.sh');
+
+  return async () => {
+    // SSH key — either reuse an existing one (HA shared key) or create.
+    let sshKeyId;
+    if (config.existingSshKeyId) {
+      sshKeyId = config.existingSshKeyId;
+    } else {
+      const sshKey = new hcloud.SshKey('ssh-key', {
+        name: `${clusterName}-${config.location}-key`,
+        publicKey: config.sshPublicKey,
+        labels,
+      });
+      sshKeyId = sshKey.id;
+    }
+
+    // Private network + subnet
+    const network = new hcloud.Network('network', {
+      name: `${clusterName}-network`,
+      ipRange: privateNetworkRange,
+      labels,
+    });
+    const subnet = new hcloud.NetworkSubnet('subnet', {
+      networkId: network.id,
+      type: 'cloud',
+      networkZone: config.networkZone,
+      ipRange: subnetRange,
+    });
+
+    // Firewall. `replaceOnChanges: ['*']` works around an upstream
+    // hcloud-go@1.32.1 bug: the Firewall `Update` code path nil-pointer
+    // panics when rules change on a live firewall. Forcing replace avoids
+    // the Update call site entirely; recreate is cheap.
+    const firewall = new hcloud.Firewall(
+      'firewall',
+      {
+        name: `${clusterName}-firewall`,
+        labels,
+        rules: [
+          {
+            direction: 'in',
+            protocol: 'tcp',
+            port: '22',
+            sourceIps: allowedSshIps,
+            description: 'SSH access',
+          },
+          {
+            direction: 'in',
+            protocol: 'tcp',
+            port: '80',
+            sourceIps: ['0.0.0.0/0', '::/0'],
+            description: 'HTTP',
+          },
+          {
+            direction: 'in',
+            protocol: 'tcp',
+            port: '443',
+            sourceIps: ['0.0.0.0/0', '::/0'],
+            description: 'HTTPS',
+          },
+          {
+            direction: 'in',
+            protocol: 'tcp',
+            port: '6443',
+            sourceIps: allowedK8sApiIps,
+            description: 'Kubernetes API',
+          },
+          {
+            direction: 'in',
+            protocol: 'tcp',
+            port: 'any',
+            sourceIps: [privateNetworkRange],
+            description: 'Internal cluster traffic (TCP)',
+          },
+          {
+            direction: 'in',
+            protocol: 'udp',
+            port: 'any',
+            sourceIps: [privateNetworkRange],
+            description: 'Internal cluster traffic (UDP)',
+          },
+        ],
+      },
+      { replaceOnChanges: ['*'], deleteBeforeReplace: true },
+    );
+
+    // Floating IP (stable ingress) — created before master so we can pass
+    // its address into the master's cloud-init script. Name includes the
+    // region (config.location) so parallel deploys across regions don't
+    // collide on the shared-across-project Hetzner namespace.
+    const floatingIp = new hcloud.FloatingIp('ingress', {
+      type: 'ipv4',
+      homeLocation: config.location,
+      name: `${clusterName}-${config.location}-ingress`,
+      labels,
+    });
+
+    // Master server — cloud-init script is rendered with floating IP, network
+    // id, and the Hetzner API token. The token + network id flow into
+    // `hcloud` and `hcloud-csi` kube-system Secrets; hcloud-cloud-controller-
+    // manager and hcloud-csi-driver fail to authenticate without them,
+    // which leaves PVCs Pending and the whole Supabase install hanging on
+    // wait-for-db.
+    const masterUserData = pulumi.all([floatingIp.ipAddress, network.id]).apply(([ip, netId]) =>
+      renderScript(masterInitTemplate, {
+        k3s_version: config.k3sVersion,
+        k3s_token: k3sToken,
+        cluster_name: clusterName,
+        disable_traefik: 'true',
+        hcloud_token: config.apiToken ?? '',
+        network_id: netId,
+        floating_ip: ip,
+      }),
+    );
+
+    const master = new hcloud.Server(
+      'master',
+      {
+        name: `${clusterName}-master`,
+        serverType: config.masterServerType,
+        image: 'ubuntu-24.04',
+        location: config.location,
+        sshKeys: [sshKeyId],
+        firewallIds: [firewall.id.apply((id) => Number.parseInt(id, 10))],
+        labels: { ...labels, role: 'master' },
+        networks: [
+          { networkId: network.id.apply((id) => Number.parseInt(id, 10)), ip: '10.0.1.1' },
+        ],
+        userData: masterUserData,
+      },
+      { dependsOn: [subnet] },
+    );
+
+    // Attach floating IP to master
+    new hcloud.FloatingIpAssignment('ingress-assignment', {
+      floatingIpId: floatingIp.id.apply((id) => Number.parseInt(id, 10)),
+      serverId: master.id.apply((id) => Number.parseInt(id, 10)),
+    });
+
+    // Supabase server — joins master via k3s agent. master_ip MUST be the
+    // master's private IP: Hetzner firewall (above) restricts public 6443
+    // to operator IPs only, so the supabase node cannot reach the master's
+    // public IP on 6443 at all. Mirrors the worker-init pattern below.
+    // Hardcoding 10.0.1.1 also drops the master.ipv4Address.apply() wrapper,
+    // removing a needless cross-resource dep that delayed cloud-init render.
+    const supabaseUserData = renderScript(supabaseInitTemplate, {
+      k3s_version: config.k3sVersion,
+      k3s_token: k3sToken,
+      master_ip: '10.0.1.1',
+    });
+    // NOTE: previously `dependsOn: [master]` — we dropped that so Hetzner
+    // provisions master + supabase in parallel, saving ~30-60s on the
+    // critical path. The supabase cloud-init (supabase-init.sh) already
+    // polls the master k3s API with a 120-attempt retry loop, so it
+    // tolerates master coming up slightly later.
+    const supabase = new hcloud.Server(
+      'supabase',
+      {
+        name: `${clusterName}-supabase`,
+        serverType: config.supabaseServerType,
+        image: 'ubuntu-24.04',
+        location: config.location,
+        sshKeys: [sshKeyId],
+        firewallIds: [firewall.id.apply((id) => Number.parseInt(id, 10))],
+        labels: { ...labels, role: 'supabase', 'node-pool': 'supabase-pool' },
+        networks: [
+          { networkId: network.id.apply((id) => Number.parseInt(id, 10)), ip: '10.0.1.2' },
+        ],
+        userData: supabaseUserData,
+      },
+      { dependsOn: [subnet] },
+    );
+
+    // Workers (spread across placement group). Name includes region so
+    // re-runs / scale across regions don't collide in Hetzner's per-project
+    // placement-group namespace.
+    const placementGroup = new hcloud.PlacementGroup('workers-pg', {
+      name: `${clusterName}-${config.location}-workers-pg`,
+      type: 'spread',
+      labels,
+    });
+    const workerUserData = renderScript(workerInitTemplate, {
+      k3s_version: config.k3sVersion,
+      k3s_token: k3sToken,
+      master_ip: '10.0.1.1',
+      cluster_name: clusterName,
+    });
+    const workers = [];
+    for (let i = 0; i < minWorkers; i++) {
+      workers.push(
+        new hcloud.Server(
+          `worker-${i + 1}`,
+          {
+            name: `${clusterName}-worker-${i + 1}`,
+            serverType: config.workerServerType,
+            image: 'ubuntu-24.04',
+            location: config.location,
+            sshKeys: [sshKeyId],
+            firewallIds: [firewall.id.apply((id) => Number.parseInt(id, 10))],
+            placementGroupId: placementGroup.id.apply((id) => Number.parseInt(id, 10)),
+            labels: {
+              ...labels,
+              role: 'worker',
+              'node-pool': 'worker-pool',
+              'cluster-autoscaler/node': 'static',
+            },
+            networks: [
+              {
+                networkId: network.id.apply((id) => Number.parseInt(id, 10)),
+                ip: `10.0.1.${10 + i}`,
+              },
+            ],
+            userData: workerUserData,
+          },
+          { dependsOn: [subnet] },
+        ),
+      );
+    }
+
+    return {
+      masterIp: master.ipv4Address,
+      masterPrivateIp: '10.0.1.1',
+      supabaseIp: supabase.ipv4Address,
+      supabasePrivateIp: '10.0.1.2',
+      workerIps: workers.map((w) => w.ipv4Address),
+      floatingIp: floatingIp.ipAddress,
+      networkId: network.id,
+      sshKeyId: typeof sshKeyId === 'string' ? sshKeyId : sshKeyId.apply((id) => String(id)),
+      k3sToken,
+      clusterName,
+    };
+  };
+}

package/src/lib/kubectl.js

@@ -0,0 +1,81 @@
+/**
+ * Kubectl helpers that avoid exposing secrets in argv.
+ *
+ * Any Kubernetes manifest containing secret data MUST use
+ * kubectlApplyManifest so the bytes flow through stdin instead of the
+ * shell command line.
+ */
+
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+/**
+ * Apply a Kubernetes manifest via `kubectl apply -f -` piped from stdin.
+ * The manifest body (including any secret data) never appears in argv.
+ *
+ * @param {object} manifest - Kubernetes resource as a plain object
+ * @param {object} [options]
+ * @param {string} [options.namespace]
+ * @param {object} [options.env]
+ * @param {number} [options.timeout=60000]
+ * @returns {string} - kubectl stdout
+ */
+export function kubectlApplyManifest(manifest, options = {}) {
+  const yaml = JSON.stringify(manifest);
+  const args = ['apply', '-f', '-'];
+  if (options.namespace) args.push('-n', options.namespace);
+  const res = spawnSync('kubectl', args, {
+    input: yaml,
+    encoding: 'utf-8',
+    env: options.env ?? process.env,
+    timeout: options.timeout ?? 60_000,
+  });
+  if (res.status !== 0) {
+    const stderr = (res.stderr || '').trim();
+    const exitCode = res.status ?? '(null)';
+    // NEVER include res.stdout — kubectl may echo the submitted manifest on
+    // failure, and the manifest may contain secret data.
+    throw new Error(`kubectl apply failed (exit ${exitCode}): ${stderr || '(no stderr)'}`);
+  }
+  return res.stdout;
+}
+
+/**
+ * Apply a strategic-merge patch to a resource via a temp patch file.
+ * Use this instead of interpolating JSON into a shell command line.
+ *
+ * @param {string} resourceRef - e.g. 'deployment/app' or 'serviceaccount/default'
+ * @param {string} namespace
+ * @param {object} patch - patch object
+ * @param {object} [options]
+ * @param {string} [options.type='strategic'] - 'strategic' | 'merge' | 'json'
+ * @param {object} [options.env]
+ * @param {boolean} [options.ignoreError]
+ * @param {number} [options.timeout=60000]
+ * @returns {string|null} - kubectl stdout, or null when ignoreError + failure
+ */
+export function kubectlPatch(resourceRef, namespace, patch, options = {}) {
+  const { type = 'strategic', env, ignoreError = false, timeout = 60_000 } = options;
+  const dir = mkdtempSync(join(tmpdir(), 'vibecarbon-patch-'));
+  const patchFile = join(dir, 'patch.json');
+  try {
+    writeFileSync(patchFile, JSON.stringify(patch), { mode: 0o600 });
+    const args = ['patch', resourceRef, '-n', namespace, '--type', type, '--patch-file', patchFile];
+    const res = spawnSync('kubectl', args, {
+      encoding: 'utf-8',
+      env: env ?? process.env,
+      timeout,
+    });
+    if (res.status !== 0) {
+      if (ignoreError) return null;
+      const stderr = (res.stderr || '').trim();
+      const exitCode = res.status ?? '(null)';
+      throw new Error(`kubectl patch failed (exit ${exitCode}): ${stderr || '(no stderr)'}`);
+    }
+    return res.stdout;
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}

package/src/lib/licensing/index.js

@@ -0,0 +1,259 @@
+/**
+ * License management for Vibecarbon
+ *
+ * Handles license storage, retrieval, activation, and validation.
+ * Licenses are stored at ~/.vibecarbon/license
+ */
+
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { c } from '../colors.js';
+import { allowsFlag as _allowsFlag, getTier, TIERS } from './tiers.js';
+import { validateLicenseKey } from './validator.js';
+
+// License storage location
+const CONFIG_DIR = join(homedir(), '.vibecarbon');
+const LICENSE_FILE = join(CONFIG_DIR, 'license');
+
+/**
+ * Ensure the config directory exists
+ */
+function ensureConfigDir() {
+  if (!existsSync(CONFIG_DIR)) {
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  }
+}
+
+/**
+ * Read the stored license file
+ * @returns {object|null} License data or null if not found
+ */
+function _readLicenseFile() {
+  if (!existsSync(LICENSE_FILE)) {
+    return null;
+  }
+
+  try {
+    const content = readFileSync(LICENSE_FILE, 'utf-8');
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Write license data to file
+ * @param {object} data - License data to store
+ */
+function writeLicenseFile(data) {
+  ensureConfigDir();
+  writeFileSync(LICENSE_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
+}
+
+/**
+ * Get the current license status
+ * @returns {object} License information with tier and features
+ */
+export function getLicense() {
+  const stored = _readLicenseFile();
+
+  // No license file → Graphite tier (free)
+  if (!stored?.key) {
+    return {
+      tier: 'graphite',
+      ...TIERS.graphite,
+      active: false,
+      message: 'No license activated. Using Graphite tier.',
+    };
+  }
+
+  // Re-validate the stored key
+  const validation = validateLicenseKey(stored.key);
+
+  // If licensing is disabled in validator, return fullerene
+  if (validation.licensingDisabled) {
+    return {
+      tier: 'fullerene',
+      ...TIERS.fullerene,
+      active: true,
+      licensingDisabled: true,
+      displayName: 'All Features Enabled',
+      message: 'Licensing disabled - all features available.',
+    };
+  }
+
+  if (!validation.valid) {
+    // Stored key is no longer valid (corrupted, etc.)
+    return {
+      tier: 'graphite',
+      ...TIERS.graphite,
+      active: false,
+      message: `License invalid: ${validation.error}. Reverted to Graphite tier.`,
+    };
+  }
+
+  const tier = getTier(validation.tier);
+
+  return {
+    tier: validation.tier,
+    ...tier,
+    active: true,
+    customerId: validation.customerId || stored.customerId,
+    activatedAt: stored.activatedAt,
+    isLifetime: true,
+    devMode: validation.devMode,
+    verified: validation.verified,
+  };
+}
+
+/**
+ * Activate a license key
+ * @param {string} key - The license key to activate
+ * @returns {object} Activation result
+ */
+export function activateLicense(key) {
+  if (!key || typeof key !== 'string') {
+    return { success: false, error: 'License key is required' };
+  }
+
+  const validation = validateLicenseKey(key.trim());
+
+  if (!validation.valid) {
+    return { success: false, error: validation.error };
+  }
+
+  const licenseData = {
+    key: key.trim(),
+    tier: validation.tier,
+    customerId: validation.customerId,
+    activatedAt: new Date().toISOString(),
+  };
+
+  try {
+    writeLicenseFile(licenseData);
+  } catch (error) {
+    return { success: false, error: `Failed to save license: ${error.message}` };
+  }
+
+  const tier = getTier(validation.tier);
+
+  return {
+    success: true,
+    tier: validation.tier,
+    tierName: tier.displayName,
+    features: tier.features,
+    isLifetime: true,
+    devMode: validation.devMode,
+  };
+}
+
+/**
+ * Deactivate (remove) the current license
+ * @returns {object} Deactivation result
+ */
+export function deactivateLicense() {
+  if (!existsSync(LICENSE_FILE)) {
+    return { success: true, message: 'No license was activated' };
+  }
+
+  try {
+    unlinkSync(LICENSE_FILE);
+    return { success: true, message: 'License deactivated. Using Graphite tier.' };
+  } catch (error) {
+    return { success: false, error: `Failed to remove license: ${error.message}` };
+  }
+}
+
+/**
+ * Check if the current license allows a specific deployment mode
+ * @param {string} deploymentFlag - The deployment flag (e.g., '--k8s', '--ha')
+ * @returns {object} Access check result
+ */
+export function checkDeploymentAccess(deploymentFlag) {
+  const license = getLicense();
+
+  // If licensing is disabled in the validator, allow everything
+  if (license.licensingDisabled) {
+    return {
+      allowed: true,
+      tier: license.tier,
+      licensingDisabled: true,
+    };
+  }
+
+  const allowed = _allowsFlag(license.tier, deploymentFlag);
+
+  return {
+    allowed,
+    tier: license.tier,
+    requiredTier: allowed ? license.tier : 'diamond',
+  };
+}
+
+/**
+ * Guard function: require any paid license or exit with upgrade message
+ * @param {string} commandName - The command that requires a license
+ */
+export function requireLicense(commandName) {
+  const license = getLicense();
+
+  if (license.licensingDisabled) return;
+  if (license.active) return;
+
+  console.log('');
+  console.log(`  ${c.warning('License required')}`);
+  console.log('');
+  console.log(
+    `  ${c.dim(`The ${c.bold(commandName)} command requires a license.`)} ${c.dim('(create, up, down, reset, status are always free)')}`,
+  );
+  console.log('');
+  console.log(
+    `  ${c.bold('Vibecarbon Diamond')}   — ${c.success('$149 lifetime')} ${c.dim('— deploy to production, indie & startup use')}`,
+  );
+  console.log(
+    `  ${c.bold('Vibecarbon Fullerene')} — ${c.success('$499 lifetime')} ${c.dim('— deploy for clients & agencies, commercial use rights')}`,
+  );
+  console.log('');
+  console.log(`  ${c.dim('Purchase:')} ${c.info('https://vibecarbon.dev/pricing')}`);
+  console.log(`  ${c.dim('Activate:')} ${c.info('vibecarbon activate <key>')}`);
+  console.log(`  ${c.dim('Terms:')}    ${c.dim('TERMS.md or https://vibecarbon.dev/terms')}`);
+  console.log('');
+  process.exit(0);
+}
+
+/**
+ * Get a formatted status message for the current license
+ * @returns {string} Status message
+ */
+export function getLicenseStatus() {
+  const license = getLicense();
+
+  if (!license.active) {
+    return `License: Graphite tier (free, no license activated)
+Features: ${TIERS.graphite.features.join(', ')}
+
+Upgrade to deploy:
+  Diamond ($149 lifetime)   — deploy to production, indie & startup use
+  Fullerene ($499 lifetime) — deploy for clients & agencies, commercial use rights
+
+Purchase at https://vibecarbon.dev/pricing`;
+  }
+
+  let status = `License: ${license.displayName}
+Customer ID: ${license.customerId}
+Activated: ${license.activatedAt}
+Features: ${license.features.join(', ')}
+Max servers: ${license.maxServers === Infinity ? 'Unlimited' : license.maxServers}
+Expires: Never (lifetime license)`;
+
+  if (license.devMode) {
+    status += '\n\n[Development Mode - Signature not verified]';
+  }
+
+  return status;
+}
+
+// Re-export tier utilities
+export { allowsFlag, compareTiers, getRequiredTier, getTier, TIERS } from './tiers.js';
+export { generateDevLicenseKey, validateLicenseKey } from './validator.js';