voidforge-build 23.9.1

package/dist/wizard/lib/provisioner-registry.js

@@ -0,0 +1,34 @@
+/**
+ * Provisioner Registry — single source of truth for provisioner map,
+ * credential scoping, and GitHub-linked target constants.
+ *
+ * ARCH-R2-002: Extracted from provision.ts + headless-deploy.ts to prevent drift.
+ */
+import { dockerProvisioner } from './provisioners/docker.js';
+import { awsVpsProvisioner } from './provisioners/aws-vps.js';
+import { vercelProvisioner } from './provisioners/vercel.js';
+import { railwayProvisioner } from './provisioners/railway.js';
+import { cloudflareProvisioner } from './provisioners/cloudflare.js';
+import { staticS3Provisioner } from './provisioners/static-s3.js';
+/** All available provisioners keyed by deploy target name. */
+export const provisioners = {
+    docker: dockerProvisioner,
+    vps: awsVpsProvisioner,
+    vercel: vercelProvisioner,
+    railway: railwayProvisioner,
+    cloudflare: cloudflareProvisioner,
+    static: staticS3Provisioner,
+};
+/** Credential scoping — each provisioner only receives vault keys it needs (ADR-020). */
+export const provisionKeys = {
+    vps: ['aws-access-key-id', 'aws-secret-access-key', 'aws-region'],
+    static: ['aws-access-key-id', 'aws-secret-access-key', 'aws-region'],
+    vercel: ['vercel-token'],
+    railway: ['railway-token'],
+    cloudflare: ['cloudflare-api-token', 'cloudflare-account-id'],
+    docker: [],
+};
+/** Deploy targets that benefit from GitHub repo linking (ADR-015). */
+export const GITHUB_LINKED_TARGETS = ['vercel', 'cloudflare', 'railway'];
+/** Deploy targets where GitHub push is optional (deploy via SSH/SDK instead). */
+export const GITHUB_OPTIONAL_TARGETS = ['vps', 'static'];

package/dist/wizard/lib/provisioners/aws-config.d.ts

@@ -0,0 +1,36 @@
+/**
+ * AWS provisioner — shared configuration, utilities, and SDK loading.
+ */
+import type { ProvisionContext, CreatedResource } from './types.js';
+export declare const POLL_INTERVAL_MS = 5000;
+export declare const MAX_POLL_MS = 300000;
+export declare function sleep(ms: number): Promise<void>;
+export declare function cancellableSleep(ms: number, signal?: AbortSignal): Promise<void>;
+export interface AwsConfig {
+    region: string;
+    credentials: {
+        accessKeyId: string;
+        secretAccessKey: string;
+    };
+}
+export declare function buildAwsConfig(ctx: ProvisionContext): AwsConfig;
+export declare function validateAwsContext(ctx: ProvisionContext): string[];
+/** Dynamic import of AWS EC2 + STS SDK modules. Returns null with error message on failure. */
+export declare function loadAwsSdk(): Promise<{
+    ec2Mod: typeof import('@aws-sdk/client-ec2');
+    stsMod: typeof import('@aws-sdk/client-sts');
+} | {
+    error: string;
+}>;
+/** Result bag passed between provisioning phases. */
+export interface AwsProvisionState {
+    resources: CreatedResource[];
+    outputs: Record<string, string>;
+    files: string[];
+    region: string;
+    slug: string;
+    sgId: string;
+    instanceId: string;
+    publicIp: string;
+    awsConfig: AwsConfig;
+}

package/dist/wizard/lib/provisioners/aws-config.js

@@ -0,0 +1,56 @@
+/**
+ * AWS provisioner — shared configuration, utilities, and SDK loading.
+ */
+import { isValidInstanceType } from '../instance-sizing.js';
+export const POLL_INTERVAL_MS = 5000;
+export const MAX_POLL_MS = 300000; // 5 minutes
+export function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+export function cancellableSleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(new Error('Aborted'));
+            return;
+        }
+        const timer = setTimeout(resolve, ms);
+        signal?.addEventListener('abort', () => { clearTimeout(timer); reject(new Error('Aborted')); }, { once: true });
+    });
+}
+export function buildAwsConfig(ctx) {
+    return {
+        region: ctx.credentials['aws-region'] || 'us-east-1',
+        credentials: {
+            accessKeyId: ctx.credentials['aws-access-key-id'],
+            secretAccessKey: ctx.credentials['aws-secret-access-key'],
+        },
+    };
+}
+export function validateAwsContext(ctx) {
+    const errors = [];
+    if (!ctx.projectDir)
+        errors.push('Project directory is required');
+    if (!ctx.projectName)
+        errors.push('Project name is required');
+    if (!ctx.credentials['aws-access-key-id'])
+        errors.push('AWS Access Key ID is required');
+    if (!ctx.credentials['aws-secret-access-key'])
+        errors.push('AWS Secret Access Key is required');
+    if (ctx.instanceType && !isValidInstanceType(ctx.instanceType)) {
+        errors.push(`Invalid instance type: "${ctx.instanceType}". Must be one of: t3.micro, t3.small, t3.medium, t3.large`);
+    }
+    return errors;
+}
+/** Dynamic import of AWS EC2 + STS SDK modules. Returns null with error message on failure. */
+export async function loadAwsSdk() {
+    try {
+        const ec2Mod = await import('@aws-sdk/client-ec2');
+        const stsMod = await import('@aws-sdk/client-sts');
+        return { ec2Mod, stsMod };
+    }
+    catch {
+        return {
+            error: 'AWS SDK not installed. Run: npm install @aws-sdk/client-ec2 @aws-sdk/client-sts @aws-sdk/client-rds @aws-sdk/client-elasticache',
+        };
+    }
+}

package/dist/wizard/lib/provisioners/aws-ec2.d.ts

@@ -0,0 +1,19 @@
+/**
+ * AWS EC2 provisioning — credential validation, key pair, security group,
+ * AMI lookup, instance launch, polling, and SSH restriction.
+ */
+import type { ProvisionContext, ProvisionEmitter } from './types.js';
+import type { InstanceType } from '../instance-sizing.js';
+import type { AwsProvisionState } from './aws-config.js';
+/** Step 1: Validate AWS credentials via STS. */
+export declare function validateCredentials(state: AwsProvisionState, stsMod: typeof import('@aws-sdk/client-sts'), emit: ProvisionEmitter): Promise<boolean>;
+/** Step 2: Create SSH key pair. */
+export declare function createKeyPair(state: AwsProvisionState, ctx: ProvisionContext, ec2Mod: typeof import('@aws-sdk/client-ec2'), emit: ProvisionEmitter): Promise<boolean>;
+/** Step 3: Create security group with ingress rules. */
+export declare function createSecurityGroup(state: AwsProvisionState, ctx: ProvisionContext, ec2Mod: typeof import('@aws-sdk/client-ec2'), emit: ProvisionEmitter): Promise<boolean>;
+/** Step 4: Find latest Amazon Linux 2023 AMI. */
+export declare function findAmi(state: AwsProvisionState, ec2Mod: typeof import('@aws-sdk/client-ec2'), emit: ProvisionEmitter): Promise<string | null>;
+/** Steps 5-6: Launch EC2 instance and wait for it to be running. */
+export declare function launchAndWaitEc2(state: AwsProvisionState, ctx: ProvisionContext, ec2Mod: typeof import('@aws-sdk/client-ec2'), amiId: string, ec2InstanceType: InstanceType, emit: ProvisionEmitter): Promise<boolean>;
+/** DEVOPS-R2-001: Restrict SSH from 0.0.0.0/0 to deployer's IP after provisioning. */
+export declare function restrictSsh(state: AwsProvisionState, emit: ProvisionEmitter): Promise<void>;

package/dist/wizard/lib/provisioners/aws-ec2.js

@@ -0,0 +1,241 @@
+/**
+ * AWS EC2 provisioning — credential validation, key pair, security group,
+ * AMI lookup, instance launch, polling, and SSH restriction.
+ */
+import { writeFile, mkdir, chmod } from 'node:fs/promises';
+import { join } from 'node:path';
+import { POLL_INTERVAL_MS, MAX_POLL_MS, cancellableSleep } from './aws-config.js';
+import { recordResourcePending, recordResourceCreated } from '../provision-manifest.js';
+/** Step 1: Validate AWS credentials via STS. */
+export async function validateCredentials(state, stsMod, emit) {
+    emit({ step: 'validate-creds', status: 'started', message: 'Validating AWS credentials' });
+    try {
+        const sts = new stsMod.STSClient(state.awsConfig);
+        const identity = await sts.send(new stsMod.GetCallerIdentityCommand({}));
+        const entityName = (identity.Arn ?? 'unknown').split(/[/:]/).pop() ?? 'unknown';
+        emit({ step: 'validate-creds', status: 'done', message: `Authenticated as ${entityName}` });
+        return true;
+    }
+    catch (err) {
+        console.error('AWS credential validation error:', err.message);
+        emit({ step: 'validate-creds', status: 'error', message: 'Invalid AWS credentials', detail: 'Check AWS Console for details' });
+        return false;
+    }
+}
+/** Step 2: Create SSH key pair. */
+export async function createKeyPair(state, ctx, ec2Mod, emit) {
+    emit({ step: 'key-pair', status: 'started', message: 'Creating SSH key pair' });
+    const keyName = `${state.slug}-deploy`;
+    try {
+        const ec2 = new ec2Mod.EC2Client(state.awsConfig);
+        await recordResourcePending(ctx.runId, 'key-pair', keyName, state.region);
+        const keyResult = await ec2.send(new ec2Mod.CreateKeyPairCommand({
+            KeyName: keyName,
+            KeyType: 'ed25519',
+        }));
+        if (!keyResult.KeyMaterial) {
+            throw new Error('AWS returned no key material — key pair may already exist');
+        }
+        const sshDir = join(ctx.projectDir, '.ssh');
+        await mkdir(sshDir, { recursive: true });
+        const keyPath = join(sshDir, 'deploy-key.pem');
+        await writeFile(keyPath, keyResult.KeyMaterial, 'utf-8');
+        await chmod(keyPath, 0o600);
+        state.files.push('.ssh/deploy-key.pem');
+        state.resources.push({ type: 'key-pair', id: keyName, region: state.region });
+        await recordResourceCreated(ctx.runId, 'key-pair', keyName, state.region);
+        state.outputs['SSH_KEY_PATH'] = '.ssh/deploy-key.pem';
+        emit({ step: 'key-pair', status: 'done', message: `Key pair "${keyName}" created` });
+        return true;
+    }
+    catch (err) {
+        console.error('Key pair creation error:', err.message);
+        emit({ step: 'key-pair', status: 'error', message: 'Failed to create key pair', detail: 'Check AWS Console for details' });
+        return false;
+    }
+}
+/** Step 3: Create security group with ingress rules. */
+export async function createSecurityGroup(state, ctx, ec2Mod, emit) {
+    emit({ step: 'security-group', status: 'started', message: 'Creating security group' });
+    try {
+        const ec2 = new ec2Mod.EC2Client(state.awsConfig);
+        await recordResourcePending(ctx.runId, 'security-group', `${state.slug}-sg`, state.region);
+        const sgResult = await ec2.send(new ec2Mod.CreateSecurityGroupCommand({
+            GroupName: `${state.slug}-sg`,
+            Description: `VoidForge security group for ${ctx.projectName}`,
+        }));
+        state.sgId = sgResult.GroupId ?? '';
+        state.resources.push({ type: 'security-group', id: state.sgId, region: state.region });
+        await recordResourceCreated(ctx.runId, 'security-group', state.sgId, state.region);
+        // Authorize inbound: SSH (22), HTTP (80), HTTPS (443)
+        // SSH initially open to 0.0.0.0/0 for provisioning — restricted to deployer IP at end (DEVOPS-R2-001).
+        const ingressRules = [
+            { IpProtocol: 'tcp', FromPort: 22, ToPort: 22, IpRanges: [{ CidrIp: '0.0.0.0/0', Description: 'SSH' }] },
+            { IpProtocol: 'tcp', FromPort: 80, ToPort: 80, IpRanges: [{ CidrIp: '0.0.0.0/0', Description: 'HTTP' }] },
+            { IpProtocol: 'tcp', FromPort: 443, ToPort: 443, IpRanges: [{ CidrIp: '0.0.0.0/0', Description: 'HTTPS' }] },
+        ];
+        // Allow DB port within the SG (self-referencing) so EC2 can reach RDS
+        if (ctx.database === 'postgres') {
+            ingressRules.push({ IpProtocol: 'tcp', FromPort: 5432, ToPort: 5432, UserIdGroupPairs: [{ GroupId: state.sgId, Description: 'PostgreSQL (SG-only)' }] });
+        }
+        else if (ctx.database === 'mysql') {
+            ingressRules.push({ IpProtocol: 'tcp', FromPort: 3306, ToPort: 3306, UserIdGroupPairs: [{ GroupId: state.sgId, Description: 'MySQL (SG-only)' }] });
+        }
+        // Allow Redis port if cache requested
+        if (ctx.cache === 'redis') {
+            ingressRules.push({ IpProtocol: 'tcp', FromPort: 6379, ToPort: 6379, UserIdGroupPairs: [{ GroupId: state.sgId, Description: 'Redis (SG-only)' }] });
+        }
+        await ec2.send(new ec2Mod.AuthorizeSecurityGroupIngressCommand({
+            GroupId: state.sgId,
+            IpPermissions: ingressRules,
+        }));
+        const portList = ingressRules.map((r) => r.FromPort).join(', ');
+        emit({ step: 'security-group', status: 'done', message: `Security group "${state.slug}-sg" created (ports ${portList})` });
+        return true;
+    }
+    catch (err) {
+        console.error('Security group creation error:', err.message);
+        emit({ step: 'security-group', status: 'error', message: 'Failed to create security group', detail: 'Check AWS Console for details' });
+        return false;
+    }
+}
+/** Step 4: Find latest Amazon Linux 2023 AMI. */
+export async function findAmi(state, ec2Mod, emit) {
+    emit({ step: 'ami-lookup', status: 'started', message: 'Finding latest Amazon Linux 2023 AMI' });
+    try {
+        const ec2 = new ec2Mod.EC2Client(state.awsConfig);
+        const amiResult = await ec2.send(new ec2Mod.DescribeImagesCommand({
+            Owners: ['amazon'],
+            Filters: [
+                { Name: 'name', Values: ['al2023-ami-*-x86_64'] },
+                { Name: 'state', Values: ['available'] },
+                { Name: 'architecture', Values: ['x86_64'] },
+            ],
+        }));
+        const images = (amiResult.Images ?? [])
+            .filter((img) => img.ImageId && img.CreationDate)
+            .sort((a, b) => (b.CreationDate ?? '').localeCompare(a.CreationDate ?? ''));
+        if (images.length === 0) {
+            throw new Error('No Amazon Linux 2023 AMI found in this region');
+        }
+        const amiId = images[0].ImageId;
+        emit({ step: 'ami-lookup', status: 'done', message: `AMI: ${amiId}` });
+        return amiId;
+    }
+    catch (err) {
+        console.error('AMI lookup error:', err.message);
+        emit({ step: 'ami-lookup', status: 'error', message: 'AMI lookup failed', detail: 'Check AWS Console for details' });
+        return null;
+    }
+}
+/** Steps 5-6: Launch EC2 instance and wait for it to be running. */
+export async function launchAndWaitEc2(state, ctx, ec2Mod, amiId, ec2InstanceType, emit) {
+    // Step 5: Launch
+    emit({ step: 'launch-ec2', status: 'started', message: `Launching EC2 instance (${ec2InstanceType})` });
+    try {
+        const ec2 = new ec2Mod.EC2Client(state.awsConfig);
+        const keyName = `${state.slug}-deploy`;
+        const userDataScript = `#!/bin/bash
+dnf update -y
+dnf install -y git curl`;
+        await recordResourcePending(ctx.runId, 'ec2-instance', 'pending', state.region);
+        const runResult = await ec2.send(new ec2Mod.RunInstancesCommand({
+            ImageId: amiId,
+            InstanceType: ec2InstanceType,
+            MinCount: 1,
+            MaxCount: 1,
+            KeyName: keyName,
+            SecurityGroupIds: [state.sgId],
+            UserData: Buffer.from(userDataScript).toString('base64'),
+            TagSpecifications: [{
+                    ResourceType: 'instance',
+                    Tags: [
+                        { Key: 'Name', Value: ctx.projectName },
+                        { Key: 'ManagedBy', Value: 'VoidForge' },
+                    ],
+                }],
+        }));
+        state.instanceId = runResult.Instances?.[0]?.InstanceId ?? '';
+        if (!state.instanceId)
+            throw new Error('No instance ID returned');
+        state.resources.push({ type: 'ec2-instance', id: state.instanceId, region: state.region });
+        await recordResourceCreated(ctx.runId, 'ec2-instance', state.instanceId, state.region);
+        emit({ step: 'launch-ec2', status: 'done', message: `Instance ${state.instanceId} launched` });
+    }
+    catch (err) {
+        console.error('EC2 launch error:', err.message);
+        emit({ step: 'launch-ec2', status: 'error', message: 'Failed to launch EC2', detail: 'Check AWS Console for details' });
+        return false;
+    }
+    // Step 6: Wait for running
+    emit({ step: 'wait-running', status: 'started', message: 'Waiting for instance to start...' });
+    try {
+        const ec2 = new ec2Mod.EC2Client(state.awsConfig);
+        const start = Date.now();
+        while (Date.now() - start < MAX_POLL_MS) {
+            await cancellableSleep(POLL_INTERVAL_MS + Math.random() * 1000, ctx.abortSignal);
+            const desc = await ec2.send(new ec2Mod.DescribeInstancesCommand({
+                InstanceIds: [state.instanceId],
+            }));
+            const instance = desc.Reservations?.[0]?.Instances?.[0];
+            const instanceState = instance?.State?.Name;
+            if (instanceState === 'running') {
+                state.publicIp = instance?.PublicIpAddress ?? '';
+                if (state.publicIp)
+                    break;
+            }
+            if (instanceState === 'terminated' || instanceState === 'shutting-down') {
+                throw new Error(`Instance entered state: ${instanceState}`);
+            }
+        }
+        if (!state.publicIp)
+            throw new Error('Instance did not get a public IP within timeout');
+        state.outputs['SSH_HOST'] = state.publicIp;
+        state.outputs['SSH_USER'] = 'ec2-user';
+        emit({ step: 'wait-running', status: 'done', message: `Instance running at ${state.publicIp}` });
+        return true;
+    }
+    catch (err) {
+        if (err.message === 'Aborted') {
+            emit({ step: 'wait-running', status: 'skipped', message: 'EC2 polling cancelled' });
+            return true; // Non-fatal abort
+        }
+        console.error('EC2 wait error:', err.message);
+        emit({ step: 'wait-running', status: 'error', message: 'Instance failed to start', detail: 'Check AWS Console for details' });
+        return false;
+    }
+}
+/** DEVOPS-R2-001: Restrict SSH from 0.0.0.0/0 to deployer's IP after provisioning. */
+export async function restrictSsh(state, emit) {
+    try {
+        const { EC2Client, RevokeSecurityGroupIngressCommand, AuthorizeSecurityGroupIngressCommand } = await import('@aws-sdk/client-ec2');
+        const ec2Restrict = new EC2Client(state.awsConfig);
+        // Detect deployer's public IP via checkip.amazonaws.com
+        let deployerIp = null;
+        try {
+            const ipRes = await fetch('https://checkip.amazonaws.com', { signal: AbortSignal.timeout(5000) });
+            if (ipRes.ok)
+                deployerIp = (await ipRes.text()).trim();
+        }
+        catch { /* non-fatal — keep 0.0.0.0/0 if detection fails */ }
+        if (deployerIp && /^\d+\.\d+\.\d+\.\d+$/.test(deployerIp)) {
+            // Revoke the wide-open SSH rule
+            await ec2Restrict.send(new RevokeSecurityGroupIngressCommand({
+                GroupId: state.sgId,
+                IpPermissions: [{ IpProtocol: 'tcp', FromPort: 22, ToPort: 22, IpRanges: [{ CidrIp: '0.0.0.0/0' }] }],
+            }));
+            // Add restricted SSH rule for deployer's IP only
+            await ec2Restrict.send(new AuthorizeSecurityGroupIngressCommand({
+                GroupId: state.sgId,
+                IpPermissions: [{ IpProtocol: 'tcp', FromPort: 22, ToPort: 22, IpRanges: [{ CidrIp: `${deployerIp}/32`, Description: 'SSH (deployer IP)' }] }],
+            }));
+            emit({ step: 'ssh-restrict', status: 'done', message: `SSH restricted to ${deployerIp}/32 (was 0.0.0.0/0)` });
+        }
+        else {
+            emit({ step: 'ssh-restrict', status: 'warning', message: 'Could not detect public IP — SSH remains open to 0.0.0.0/0. Restrict manually in AWS Console.' });
+        }
+    }
+    catch (err) {
+        emit({ step: 'ssh-restrict', status: 'warning', message: 'SSH restriction failed (non-fatal). Restrict port 22 manually.', detail: err.message });
+    }
+}

package/dist/wizard/lib/provisioners/aws-rds.d.ts

@@ -0,0 +1,10 @@
+/**
+ * AWS RDS + ElastiCache provisioning — database and cache service creation with polling.
+ */
+import type { ProvisionContext, ProvisionEmitter } from './types.js';
+import type { InstanceType as Ec2InstanceType } from '../instance-sizing.js';
+import type { AwsProvisionState } from './aws-config.js';
+/** Step 7: Provision RDS database (postgres or mysql). Non-fatal on failure. */
+export declare function provisionRds(state: AwsProvisionState, ctx: ProvisionContext, ec2InstanceType: Ec2InstanceType, emit: ProvisionEmitter): Promise<void>;
+/** Step 8: Provision ElastiCache Redis cluster. Non-fatal on failure. */
+export declare function provisionElastiCache(state: AwsProvisionState, ctx: ProvisionContext, ec2InstanceType: Ec2InstanceType, emit: ProvisionEmitter): Promise<void>;

package/dist/wizard/lib/provisioners/aws-rds.js

@@ -0,0 +1,199 @@
+/**
+ * AWS RDS + ElastiCache provisioning — database and cache service creation with polling.
+ */
+import { randomBytes } from 'node:crypto';
+import { cancellableSleep } from './aws-config.js';
+import { rdsInstanceClass, cacheNodeType } from '../instance-sizing.js';
+import { recordResourcePending, recordResourceCreated } from '../provision-manifest.js';
+/** Step 7: Provision RDS database (postgres or mysql). Non-fatal on failure. */
+export async function provisionRds(state, ctx, ec2InstanceType, emit) {
+    if (ctx.database !== 'postgres' && ctx.database !== 'mysql') {
+        emit({ step: 'rds', status: 'skipped', message: 'No database requested' });
+        return;
+    }
+    emit({ step: 'rds', status: 'started', message: `Creating RDS instance (${ctx.database})` });
+    try {
+        const { RDSClient, CreateDBInstanceCommand, DescribeDBInstancesCommand } = await import('@aws-sdk/client-rds');
+        const rds = new RDSClient(state.awsConfig);
+        const engine = ctx.database === 'postgres' ? 'postgres' : 'mysql';
+        const port = ctx.database === 'postgres' ? 5432 : 3306;
+        const dbInstanceId = `${state.slug}-db`;
+        // IG-R2: Random username instead of hardcoded 'admin'
+        const dbUsername = `vf_${randomBytes(4).toString('hex')}`;
+        const specials = '!@#$%^&*';
+        const suffix = String.fromCharCode(65 + Math.floor(Math.random() * 26)) + Math.floor(Math.random() * 10) + specials[Math.floor(Math.random() * specials.length)];
+        const dbPassword = randomBytes(16).toString('hex') + suffix;
+        await recordResourcePending(ctx.runId, 'rds-instance', dbInstanceId, state.region);
+        await rds.send(new CreateDBInstanceCommand({
+            DBInstanceIdentifier: dbInstanceId,
+            DBInstanceClass: rdsInstanceClass(ec2InstanceType),
+            Engine: engine,
+            MasterUsername: dbUsername,
+            MasterUserPassword: dbPassword,
+            AllocatedStorage: 20,
+            PubliclyAccessible: false,
+            VpcSecurityGroupIds: [state.sgId],
+            Tags: [
+                { Key: 'Name', Value: `${ctx.projectName}-db` },
+                { Key: 'ManagedBy', Value: 'VoidForge' },
+            ],
+        }));
+        state.resources.push({ type: 'rds-instance', id: dbInstanceId, region: state.region });
+        await recordResourceCreated(ctx.runId, 'rds-instance', dbInstanceId, state.region);
+        state.outputs['DB_ENGINE'] = engine;
+        state.outputs['DB_PORT'] = String(port);
+        state.outputs['DB_INSTANCE_ID'] = dbInstanceId;
+        state.outputs['DB_USERNAME'] = dbUsername;
+        state.outputs['DB_PASSWORD'] = dbPassword;
+        emit({ step: 'rds', status: 'done', message: `RDS instance "${dbInstanceId}" created — waiting for endpoint` });
+        // Step 7b: Poll RDS until available (non-fatal on timeout)
+        await pollRdsEndpoint(state, ctx, rds, DescribeDBInstancesCommand, dbInstanceId, emit);
+    }
+    catch (err) {
+        console.error('RDS creation error:', err.message);
+        emit({ step: 'rds', status: 'error', message: 'Failed to create RDS instance', detail: 'Check AWS Console for details' });
+        // Non-fatal — continue without DB
+    }
+}
+async function pollRdsEndpoint(state, ctx, rds, DescribeDBInstancesCommand, dbInstanceId, emit) {
+    const RDS_POLL_MS = 10000;
+    const RDS_TIMEOUT_MS = 900000; // 15 minutes
+    const RDS_PROGRESS_MS = 30000;
+    emit({ step: 'rds-wait', status: 'started', message: 'Waiting for RDS to become available (5-10 minutes)...' });
+    try {
+        const rdsStart = Date.now();
+        let lastProgress = rdsStart;
+        let dbHost = '';
+        while (Date.now() - rdsStart < RDS_TIMEOUT_MS) {
+            await cancellableSleep(RDS_POLL_MS + Math.random() * 2000, ctx.abortSignal);
+            const desc = await rds.send(new DescribeDBInstancesCommand({
+                DBInstanceIdentifier: dbInstanceId,
+            }));
+            const instance = desc.DBInstances?.[0];
+            const status = instance?.DBInstanceStatus;
+            if (status === 'available') {
+                dbHost = instance?.Endpoint?.Address ?? '';
+                break;
+            }
+            // Check for terminal failure states
+            const rdsTerminalStates = ['failed', 'deleting', 'deleted', 'incompatible-parameters', 'incompatible-restore', 'storage-full'];
+            if (status && rdsTerminalStates.includes(status)) {
+                emit({ step: 'rds-wait', status: 'error', message: `RDS entered terminal state: ${status}`, detail: 'Check AWS Console for details' });
+                break;
+            }
+            // Emit progress every 30 seconds
+            if (Date.now() - lastProgress >= RDS_PROGRESS_MS) {
+                const elapsed = Math.round((Date.now() - rdsStart) / 1000);
+                emit({ step: 'rds-wait', status: 'started', message: `RDS status: ${status || 'creating'}... (${elapsed}s elapsed)` });
+                lastProgress = Date.now();
+            }
+        }
+        if (dbHost) {
+            state.outputs['DB_HOST'] = dbHost;
+            emit({ step: 'rds-wait', status: 'done', message: `RDS available at ${dbHost}` });
+        }
+        else {
+            emit({ step: 'rds-wait', status: 'error', message: 'RDS polling timed out after 15 minutes', detail: `Instance "${dbInstanceId}" is still provisioning. Check the AWS Console for the endpoint and add DB_HOST to your .env manually.` });
+        }
+    }
+    catch (pollErr) {
+        if (pollErr.message === 'Aborted') {
+            emit({ step: 'rds-wait', status: 'skipped', message: 'RDS polling cancelled' });
+        }
+        else {
+            console.error('RDS polling error:', pollErr.message);
+            emit({ step: 'rds-wait', status: 'error', message: 'RDS polling failed', detail: 'Check AWS Console for details' });
+        }
+        // Non-fatal — continue without DB_HOST
+    }
+}
+/** Step 8: Provision ElastiCache Redis cluster. Non-fatal on failure. */
+export async function provisionElastiCache(state, ctx, ec2InstanceType, emit) {
+    if (ctx.cache !== 'redis') {
+        emit({ step: 'elasticache', status: 'skipped', message: 'No cache requested' });
+        return;
+    }
+    emit({ step: 'elasticache', status: 'started', message: 'Creating ElastiCache Redis cluster' });
+    try {
+        const { ElastiCacheClient, CreateCacheClusterCommand, DescribeCacheClustersCommand } = await import('@aws-sdk/client-elasticache');
+        const elasticache = new ElastiCacheClient(state.awsConfig);
+        const clusterId = `${state.slug}-redis`;
+        await recordResourcePending(ctx.runId, 'elasticache-cluster', clusterId, state.region);
+        // Note: CreateCacheClusterCommand does not support AuthToken — Redis AUTH requires
+        // CreateReplicationGroupCommand with TransitEncryptionEnabled. Security relies on
+        // SG isolation (only instances in the same SG can reach the Redis port). (IG-R3)
+        await elasticache.send(new CreateCacheClusterCommand({
+            CacheClusterId: clusterId,
+            CacheNodeType: cacheNodeType(ec2InstanceType),
+            Engine: 'redis',
+            NumCacheNodes: 1,
+            Tags: [
+                { Key: 'Name', Value: `${ctx.projectName}-redis` },
+                { Key: 'ManagedBy', Value: 'VoidForge' },
+            ],
+        }));
+        state.resources.push({ type: 'elasticache-cluster', id: clusterId, region: state.region });
+        await recordResourceCreated(ctx.runId, 'elasticache-cluster', clusterId, state.region);
+        state.outputs['REDIS_CLUSTER_ID'] = clusterId;
+        emit({ step: 'elasticache', status: 'done', message: `ElastiCache cluster "${clusterId}" created — waiting for endpoint` });
+        // Step 8b: Poll ElastiCache until available
+        await pollCacheEndpoint(state, ctx, elasticache, DescribeCacheClustersCommand, clusterId, emit);
+    }
+    catch (err) {
+        console.error('ElastiCache creation error:', err.message);
+        emit({ step: 'elasticache', status: 'error', message: 'Failed to create ElastiCache cluster', detail: 'Check AWS Console for details' });
+        // Non-fatal
+    }
+}
+async function pollCacheEndpoint(state, ctx, elasticache, DescribeCacheClustersCommand, clusterId, emit) {
+    const CACHE_POLL_MS = 5000;
+    const CACHE_TIMEOUT_MS = 300000; // 5 minutes
+    const CACHE_PROGRESS_MS = 15000;
+    emit({ step: 'cache-wait', status: 'started', message: 'Waiting for Redis to become available (1-2 minutes)...' });
+    try {
+        const cacheStart = Date.now();
+        let lastCacheProgress = cacheStart;
+        let redisHost = '';
+        while (Date.now() - cacheStart < CACHE_TIMEOUT_MS) {
+            await cancellableSleep(CACHE_POLL_MS + Math.random() * 1000, ctx.abortSignal);
+            const desc = await elasticache.send(new DescribeCacheClustersCommand({
+                CacheClusterId: clusterId,
+                ShowCacheNodeInfo: true,
+            }));
+            const cluster = desc.CacheClusters?.[0];
+            const status = cluster?.CacheClusterStatus;
+            if (status === 'available') {
+                redisHost = cluster?.CacheNodes?.[0]?.Endpoint?.Address ?? '';
+                break;
+            }
+            // Check for terminal failure states
+            const cacheTerminalStates = ['deleted', 'deleting', 'create-failed', 'snapshotting'];
+            if (status && cacheTerminalStates.includes(status)) {
+                emit({ step: 'cache-wait', status: 'error', message: `Redis entered terminal state: ${status}`, detail: 'Check AWS Console for details' });
+                break;
+            }
+            if (Date.now() - lastCacheProgress >= CACHE_PROGRESS_MS) {
+                const elapsed = Math.round((Date.now() - cacheStart) / 1000);
+                emit({ step: 'cache-wait', status: 'started', message: `Redis status: ${status || 'creating'}... (${elapsed}s elapsed)` });
+                lastCacheProgress = Date.now();
+            }
+        }
+        if (redisHost) {
+            state.outputs['REDIS_HOST'] = redisHost;
+            state.outputs['REDIS_PORT'] = '6379';
+            emit({ step: 'cache-wait', status: 'done', message: `Redis available at ${redisHost}:6379` });
+        }
+        else {
+            emit({ step: 'cache-wait', status: 'error', message: 'Redis polling timed out after 5 minutes', detail: `Cluster "${clusterId}" is still provisioning. Check the AWS Console for the endpoint.` });
+        }
+    }
+    catch (pollErr) {
+        if (pollErr.message === 'Aborted') {
+            emit({ step: 'cache-wait', status: 'skipped', message: 'Redis polling cancelled' });
+        }
+        else {
+            console.error('Redis polling error:', pollErr.message);
+            emit({ step: 'cache-wait', status: 'error', message: 'Redis polling failed', detail: 'Check AWS Console for details' });
+        }
+    }
+}

package/dist/wizard/lib/provisioners/aws-vps.d.ts

@@ -0,0 +1,6 @@
+/**
+ * AWS VPS provisioner — orchestrator that coordinates EC2, RDS, ElastiCache,
+ * script generation, env writing, and cleanup.
+ */
+import type { Provisioner } from './types.js';
+export declare const awsVpsProvisioner: Provisioner;