vibecarbon 0.1.0

package/src/lib/project.js

@@ -0,0 +1,334 @@
+/**
+ * Project detection and manifest management utilities
+ * Shared across CLI commands (add.js, s3.js, deploy.js, etc.)
+ */
+
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { escapeDotenv } from './shell.js';
+
+// ============================================================================
+// PACKAGE MANAGER DETECTION
+// ============================================================================
+
+/**
+ * Detect the package manager used by a project.
+ * Checks lock files first, then package.json packageManager field, falls back to pnpm.
+ *
+ * @param {string} [cwd] - Working directory (defaults to process.cwd())
+ * @returns {'npm'|'pnpm'|'bun'}
+ */
+export function detectPackageManager(cwd = process.cwd()) {
+  if (existsSync(join(cwd, 'pnpm-lock.yaml'))) return 'pnpm';
+  if (existsSync(join(cwd, 'bun.lock')) || existsSync(join(cwd, 'bun.lockb'))) return 'bun';
+  if (existsSync(join(cwd, 'package-lock.json'))) return 'npm';
+
+  const pkgPath = join(cwd, 'package.json');
+  if (existsSync(pkgPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+      if (pkg.packageManager) {
+        const pm = pkg.packageManager.split('@')[0];
+        if (['npm', 'pnpm', 'bun'].includes(pm)) return pm;
+      }
+    } catch {
+      // Ignore parse errors
+    }
+  }
+
+  return 'pnpm';
+}
+
+// ============================================================================
+// MANIFEST MANAGEMENT (.vibecarbon.json services tracking)
+// ============================================================================
+
+/**
+ * Load the project manifest (.vibecarbon.json)
+ * This tracks which services have been added to the project
+ *
+ * @param {string} [cwd] - Working directory (defaults to process.cwd())
+ * @returns {object} - Manifest object with version and services
+ */
+export function loadManifest(cwd = process.cwd()) {
+  const manifestPath = join(cwd, '.vibecarbon.json');
+  if (existsSync(manifestPath)) {
+    return JSON.parse(readFileSync(manifestPath, 'utf-8'));
+  }
+  return { version: '1', services: {} };
+}
+
+/**
+ * Save the project manifest (.vibecarbon.json)
+ *
+ * @param {object} manifest - Manifest object to save
+ * @param {string} [cwd] - Working directory (defaults to process.cwd())
+ */
+export function saveManifest(manifest, cwd = process.cwd()) {
+  const manifestPath = join(cwd, '.vibecarbon.json');
+  writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+}
+
+// ============================================================================
+// ENVIRONMENT FILE MANAGEMENT
+// ============================================================================
+
+/**
+ * Parse a dotenv-format string into a key-value object.
+ *
+ * Supports:
+ *   - Single-quoted values (produced by serializeDotenv / escapeDotenv)
+ *   - Legacy double-quoted values (for backwards compatibility with
+ *     previously-written files using the old KEY="value" format)
+ *   - Unquoted values (no embedded whitespace)
+ *   - Multi-line single-quoted values (value spans multiple lines)
+ *   - Comment lines (#) and blank lines are ignored
+ *
+ * The single-quoted branch uses a tiny state machine that correctly handles
+ * the '\'' close-reopen escape AND literal backslashes (which are not
+ * escape characters in POSIX single-quoted strings).
+ */
+export function parseDotenv(text) {
+  const out = {};
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line || line.startsWith('#')) continue;
+    const m = line.match(/^([A-Z_][A-Z0-9_]*)=(.*)$/);
+    if (!m) continue;
+    const key = m[1];
+    const rest = m[2];
+
+    if (rest.startsWith("'")) {
+      // Scan forward, possibly consuming more lines, until we find the
+      // closing single-quote. The only "escape" in POSIX single-quoted
+      // strings is the close-reopen trick: '\'' produces a literal '.
+      // We consume buffer[pos] one char at a time starting after the
+      // opening '.
+      let buf = rest.slice(1);
+      const parts = [];
+      let done = false;
+      while (!done) {
+        let pos = 0;
+        while (pos < buf.length) {
+          const ch = buf[pos];
+          if (ch === "'") {
+            // Check for close-reopen '\''
+            if (buf.slice(pos, pos + 4) === "'\\''") {
+              parts.push("'");
+              pos += 4;
+            } else {
+              // Actual closing quote.
+              done = true;
+              break;
+            }
+          } else {
+            parts.push(ch);
+            pos += 1;
+          }
+        }
+        if (done) break;
+        // Exhausted this line without finding the close — consume the next.
+        if (i + 1 >= lines.length) {
+          // Malformed: unterminated single quote. Salvage what we have.
+          done = true;
+          break;
+        }
+        parts.push('\n');
+        i += 1;
+        buf = lines[i];
+      }
+      out[key] = parts.join('');
+    } else if (rest.startsWith('"')) {
+      // Legacy double-quoted. No escape handling (pre-C-8 files used simple "...").
+      const closeIdx = rest.indexOf('"', 1);
+      if (closeIdx !== -1) out[key] = rest.slice(1, closeIdx);
+    } else {
+      // Unquoted value — up to first whitespace-then-# or end of line.
+      out[key] = rest.replace(/\s+#.*$/, '').trim();
+    }
+  }
+  return out;
+}
+
+/**
+ * Serialize a key-value object into dotenv format using escapeDotenv
+ * (single-quoted, safe for dotenv-package parsers).
+ */
+export function serializeDotenv(obj) {
+  return `${Object.entries(obj)
+    .map(([k, v]) => `${k}=${escapeDotenv(v)}`)
+    .join('\n')}\n`;
+}
+
+/**
+ * Load environment variables from .env.local
+ *
+ * @param {string} [cwd] - Working directory (defaults to process.cwd())
+ * @returns {object} - Key-value object of environment variables
+ */
+export function loadEnvVariables(cwd = process.cwd()) {
+  const envPath = join(cwd, '.env.local');
+  if (!existsSync(envPath)) return {};
+  return parseDotenv(readFileSync(envPath, 'utf-8'));
+}
+
+/**
+ * Append a section of environment variables to .env.local and .env
+ *
+ * @param {string} sectionName - Name for the section header (e.g., 'N8N', 'S3 STORAGE')
+ * @param {object} envVars - Key-value pairs to add
+ * @param {string} [cwd] - Working directory (defaults to process.cwd())
+ */
+export function appendToEnv(sectionName, envVars, cwd = process.cwd()) {
+  const envFiles = ['.env.local', '.env'];
+  for (const filename of envFiles) {
+    const envPath = join(cwd, filename);
+    if (!existsSync(envPath)) continue;
+    const content = readFileSync(envPath, 'utf-8');
+    const sectionHeader = `# ${sectionName.toUpperCase()}`;
+    if (content.includes(sectionHeader)) continue;
+    const body = Object.entries(envVars)
+      .map(([k, v]) => `${k}=${escapeDotenv(v)}`)
+      .join('\n');
+    const newSection = `\n\n# =============================================================================\n# ${sectionName.toUpperCase()}\n# =============================================================================\n\n${body}\n`;
+    writeFileSync(envPath, content.trimEnd() + newSection);
+  }
+}
+
+/**
+ * Set or update a single environment variable in .env.local and .env
+ *
+ * @param {string} key - Variable name
+ * @param {string} value - Variable value
+ * @param {string} [cwd] - Working directory (defaults to process.cwd())
+ */
+export function setEnvVar(key, value, cwd = process.cwd()) {
+  const envFiles = ['.env.local', '.env'];
+  for (const filename of envFiles) {
+    const envPath = join(cwd, filename);
+    if (!existsSync(envPath)) continue;
+    const content = readFileSync(envPath, 'utf-8');
+    // Match either legacy KEY="..." or new KEY='...' forms at line start.
+    const regex = new RegExp(`^${key}=(?:"[^"]*"|'(?:[^']|'\\\\'')*')`, 'm');
+    const replacement = `${key}=${escapeDotenv(value)}`;
+    if (regex.test(content)) {
+      writeFileSync(envPath, content.replace(regex, replacement));
+    } else {
+      writeFileSync(envPath, `${content.trimEnd()}\n${replacement}\n`);
+    }
+  }
+}
+
+// ============================================================================
+// GIT ADD ALLOWLIST
+// ============================================================================
+
+/**
+ * Allowlist of paths that vibecarbon knows are safe to commit.
+ * Used by add/deploy/push in place of `git add .` to prevent leaking
+ * `.vibecarbon/`, `.env.local`, or other untracked secrets.
+ */
+const PROJECT_GIT_ADD_ALLOWLIST = [
+  // Top-level config
+  '.gitignore',
+  '.dockerignore',
+  '.github/',
+  '.claude/',
+  'package.json',
+  'pnpm-lock.yaml',
+  'package-lock.json',
+  'bun.lock',
+  'bun.lockb',
+  'biome.json',
+  'tsconfig.json',
+  'tsconfig.server.json',
+  'vite.config.ts',
+  'components.json',
+  // Docker
+  'Dockerfile',
+  'docker-entrypoint.sh',
+  'docker-compose.yml',
+  'docker-compose.prod.yml',
+  'docker-compose.override.yml',
+  'docker-compose.metabase.yml',
+  'docker-compose.metabase.prod.yml',
+  'docker-compose.metabase.override.yml',
+  'docker-compose.n8n.yml',
+  'docker-compose.n8n.prod.yml',
+  'docker-compose.n8n.override.yml',
+  'docker-compose.observability.yml',
+  'docker-compose.observability.prod.yml',
+  'docker-compose.observability.override.yml',
+  // Source
+  'src/',
+  'scripts/',
+  'content/',
+  'backup/',
+  'ha/',
+  'k8s/',
+  'supabase/',
+  'cloud-init/',
+  'volumes/',
+  // Docs and metadata
+  'README.md',
+  'LICENSE',
+  'AGENTS.md',
+  'CLAUDE.md',
+  'DEVELOPMENT.md',
+  'PRODUCTION.md',
+  'CHANGELOG.md',
+];
+
+/**
+ * Build a `git add` argv limited to template-known paths that exist.
+ * The first 3 tokens ('git', 'add', '--') are always included; the rest
+ * are filtered by existsSync so missing optional paths don't error.
+ *
+ * If NO allowlisted path exists in cwd, the result is ['git', 'add', '--']
+ * with no trailing paths — git will exit 0 with a "nothing added" message
+ * on stderr. Callers pass silent:true + ignoreError:true to make this a no-op.
+ *
+ * @param {string} [cwd] - Working directory (defaults to process.cwd())
+ * @param {string[]} [extras] - Additional paths to include (also filtered by existsSync)
+ * @returns {string[]} argv array safe to pass to runCommand
+ */
+export function buildGitAddArgv(cwd = process.cwd(), extras = []) {
+  const paths = [...PROJECT_GIT_ADD_ALLOWLIST, ...extras].filter((p) => existsSync(join(cwd, p)));
+  return ['git', 'add', '--', ...paths];
+}
+
+// ============================================================================
+// GITIGNORE VALIDATION
+// ============================================================================
+
+/**
+ * Check that a .gitignore file contains the required security patterns.
+ * Returns an array of missing patterns (empty array on success).
+ *
+ * @param {string} gitignorePath - Absolute path to the .gitignore file
+ * @returns {string[]} Array of missing patterns
+ */
+export function validateGitignore(gitignorePath) {
+  let content;
+  try {
+    content = readFileSync(gitignorePath, 'utf-8');
+  } catch {
+    return ['.gitignore is missing'];
+  }
+  const lines = content
+    .split('\n')
+    .map((l) => l.trim())
+    .filter((l) => l && !l.startsWith('#'));
+  const required = [
+    '.vibecarbon/',
+    '.env',
+    '.env.local',
+    '.env.*.local',
+    '*.pem',
+    '*.key',
+    '*.tfstate',
+    '*.tfstate.*',
+  ];
+  return required.filter((r) => !lines.includes(r));
+}

package/src/lib/providers/base.js

@@ -0,0 +1,276 @@
+/**
+ * Base Provider Interface
+ *
+ * Abstract base class that defines the interface for cloud providers.
+ * All cloud providers (Hetzner, DigitalOcean, Vultr, etc.) must implement
+ * this interface to be used with Vibecarbon.
+ *
+ * To add a new provider:
+ * 1. Create a new file (e.g., digitalocean.js) that extends BaseProvider
+ * 2. Implement all abstract methods
+ * 3. Add static NAME, REGIONS, and SERVER_TYPES properties
+ * 4. Register the provider in index.js
+ */
+
+export class BaseProvider {
+  /**
+   * Provider display name (e.g., "Hetzner Cloud")
+   * @type {string}
+   */
+  static NAME = 'Base Provider';
+
+  /**
+   * API base URL
+   * @type {string}
+   */
+  static API_BASE = '';
+
+  /**
+   * Available regions
+   * @type {Object<string, string>}
+   */
+  static REGIONS = {};
+
+  /**
+   * Available server types
+   * @type {Object<string, {vcpu: number, ram: number, disk: number, price: string}>}
+   */
+  static SERVER_TYPES = {};
+
+  /**
+   * Default server type
+   * @type {string}
+   */
+  static DEFAULT_TYPE = '';
+
+  /**
+   * Default region for HA deployments
+   * @type {string[]}
+   */
+  static HA_REGIONS = [];
+
+  /**
+   * Create a new provider instance
+   * @param {string} apiToken - API token for authentication
+   */
+  constructor(apiToken) {
+    if (!apiToken) {
+      throw new Error('API token is required');
+    }
+    this.apiToken = apiToken;
+  }
+
+  /**
+   * Get the provider name
+   * @returns {string}
+   */
+  getName() {
+    return this.constructor.NAME;
+  }
+
+  /**
+   * Get available regions
+   * @returns {Object<string, string>}
+   */
+  getRegions() {
+    return this.constructor.REGIONS;
+  }
+
+  /**
+   * Get available server types
+   * @returns {Object<string, object>}
+   */
+  getServerTypes() {
+    return this.constructor.SERVER_TYPES;
+  }
+
+  /**
+   * Get the default server type
+   * @returns {string}
+   */
+  getDefaultType() {
+    return this.constructor.DEFAULT_TYPE;
+  }
+
+  /**
+   * Get default regions for HA deployment
+   * @returns {string[]}
+   */
+  getHARegions() {
+    return this.constructor.HA_REGIONS;
+  }
+
+  // ============================================================================
+  // ABSTRACT METHODS - Must be implemented by subclasses
+  // ============================================================================
+
+  /**
+   * Create a new server
+   * @param {object} config - Server configuration
+   * @param {string} config.name - Server name
+   * @param {string} config.serverType - Server type/size
+   * @param {string} config.region - Region/location
+   * @param {string|number} config.sshKeyId - SSH key ID
+   * @param {string} config.environment - Environment name
+   * @returns {Promise<{id: string|number, server?: object}>}
+   */
+  async createServer(_config) {
+    throw new Error('createServer() must be implemented by subclass');
+  }
+
+  /**
+   * Delete a server
+   * @param {string|number} serverId - Server ID
+   * @returns {Promise<void>}
+   */
+  async deleteServer(_serverId) {
+    throw new Error('deleteServer() must be implemented by subclass');
+  }
+
+  /**
+   * Get server details
+   * @param {string|number} serverId - Server ID
+   * @returns {Promise<object>}
+   */
+  async getServer(_serverId) {
+    throw new Error('getServer() must be implemented by subclass');
+  }
+
+  /**
+   * Wait for a server to become ready/running
+   * @param {string|number} serverId - Server ID
+   * @param {number} [timeout=300000] - Timeout in milliseconds
+   * @returns {Promise<object>} Server details when ready
+   */
+  async waitForServer(_serverId, _timeout = 300000) {
+    throw new Error('waitForServer() must be implemented by subclass');
+  }
+
+  /**
+   * Create or get an SSH key
+   * @param {string} name - SSH key name
+   * @param {string} publicKey - Public key content
+   * @returns {Promise<string|number>} SSH key ID
+   */
+  async createSSHKey(_name, _publicKey) {
+    throw new Error('createSSHKey() must be implemented by subclass');
+  }
+
+  /**
+   * Delete an SSH key
+   * @param {string|number} keyId - SSH key ID
+   * @returns {Promise<void>}
+   */
+  async deleteSSHKey(_keyId) {
+    throw new Error('deleteSSHKey() must be implemented by subclass');
+  }
+
+  /**
+   * Create a firewall and attach it to a server
+   * @param {string} name - Firewall name
+   * @param {string|number} serverId - Server ID to attach to
+   * @param {number[]} [ports=[22, 80, 443]] - Ports to open
+   * @returns {Promise<object>}
+   */
+  async createFirewall(_name, _serverId, _ports = [22, 80, 443]) {
+    throw new Error('createFirewall() must be implemented by subclass');
+  }
+
+  /**
+   * Delete a firewall
+   * @param {string|number} firewallId - Firewall ID
+   * @returns {Promise<void>}
+   */
+  async deleteFirewall(_firewallId) {
+    throw new Error('deleteFirewall() must be implemented by subclass');
+  }
+
+  /**
+   * List servers matching labels/tags
+   * @param {object} labels - Labels to filter by
+   * @returns {Promise<object[]>}
+   */
+  async listServers(_labels = {}) {
+    throw new Error('listServers() must be implemented by subclass');
+  }
+
+  /**
+   * List firewalls matching labels/tags
+   * @param {object} labels - Labels to filter by
+   * @returns {Promise<object[]>}
+   */
+  async listFirewalls(_labels = {}) {
+    throw new Error('listFirewalls() must be implemented by subclass');
+  }
+
+  /**
+   * List SSH keys
+   * @returns {Promise<object[]>}
+   */
+  async listSSHKeys() {
+    throw new Error('listSSHKeys() must be implemented by subclass');
+  }
+
+  // ============================================================================
+  // HELPER METHODS - Can be overridden if needed
+  // ============================================================================
+
+  /**
+   * Make an authenticated API request
+   * @param {string} endpoint - API endpoint (relative to API_BASE)
+   * @param {object} [options={}] - Fetch options
+   * @returns {Promise<Response>}
+   */
+  async apiRequest(endpoint, options = {}) {
+    const url = `${this.constructor.API_BASE}${endpoint}`;
+    const headers = {
+      Authorization: `Bearer ${this.apiToken}`,
+      'Content-Type': 'application/json',
+      ...options.headers,
+    };
+
+    // Delegate to the shared fetch-retry helper so "fetch failed" /
+    // ECONNRESET / EAI_AGAIN from Hetzner gets 5 tries with exponential
+    // backoff instead of the previous 3. Transient 5xx / 429 also retry.
+    const { fetchWithRetry } = await import('../fetch-retry.js');
+    return await fetchWithRetry(url, { ...options, headers });
+  }
+
+  /**
+   * Validate that a region is supported
+   * @param {string} region - Region ID
+   * @returns {boolean}
+   */
+  isValidRegion(region) {
+    return region in this.constructor.REGIONS;
+  }
+
+  /**
+   * Validate that a server type is supported
+   * @param {string} serverType - Server type ID
+   * @returns {boolean}
+   */
+  isValidServerType(serverType) {
+    return serverType in this.constructor.SERVER_TYPES;
+  }
+
+  /**
+   * Format a region ID to display name
+   * @param {string} region - Region ID
+   * @returns {string}
+   */
+  formatRegion(region) {
+    return this.constructor.REGIONS[region] || region;
+  }
+
+  /**
+   * Format a server type to display string
+   * @param {string} serverType - Server type ID
+   * @returns {string}
+   */
+  formatServerType(serverType) {
+    const type = this.constructor.SERVER_TYPES[serverType];
+    if (!type) return serverType;
+    return `${serverType} (${type.vcpu} vCPU, ${type.ram}GB RAM, ${type.disk}GB SSD, ${type.price})`;
+  }
+}