Deploy, Ambientes, Versionado y Release MVP

# ============================================================
# FARO Connect · .env.example
# Copiar a .env.local para desarrollo. NO commitear .env.local.
# ============================================================

# Application
APP_ENV=local
APP_URL=http://localhost:3000
NODE_ENV=development

# Database / Cache
DATABASE_URL=postgresql://faro:faro@localhost:54329/faro_demo
REDIS_URL=redis://localhost:63799

# FARO config
FARO_DEFAULT_TIMEZONE=America/Argentina/Mendoza
FARO_DEMO_MODE=true
FARO_TEST_NOW=2026-05-31T18:00:00-03:00

# Auth
AUTH_SECRET=change-me-in-real-env
SESSION_COOKIE_NAME=faro_session
ENCRYPTION_KEY=change-me-32-chars-random
API_KEY_SALT=change-me-32-chars-random

# Storage
STORAGE_PROVIDER=fake
STORAGE_BUCKET_EVIDENCE=faro-evidence-local
STORAGE_BUCKET_REPORTS=faro-reports-local

# Email
EMAIL_PROVIDER=fake
EMAIL_FROM=FARO Connect <no-reply@farodireccion.com>
EMAIL_ALLOWED_DOMAINS=farodireccion.com
EMAIL_API_KEY=

# AI
AI_PROVIDER=fallback
AI_MODEL_DEFAULT=fallback
AI_DAILY_BUDGET_USD=0
AI_API_KEY=

# Observability
SENTRY_DSN=
SENTRY_ENVIRONMENT=local
SENTRY_RELEASE=
LOG_LEVEL=debug

# Environment files
.env
.env.*
!.env.example
!.env.demo.example
!.env.staging.example
!.env.production.example

# Build artifacts
node_modules
.next
dist
build
coverage
playwright-report
test-results

# Logs
*.log
.DS_Store

# Credentials / keys
service-account*.json
*.pem
*.key
*.p12

const requiredEnv = [
  "APP_ENV",
  "APP_URL",
  "DATABASE_URL",
  "REDIS_URL",
  "AUTH_SECRET"
];

export function validateEnv() {
  const missing = requiredEnv.filter((key) => !process.env[key]);

  if (missing.length > 0) {
    throw new Error(`MISSING_ENV_VARS: ${missing.join(", ")}`);
  }

  // Guard: producción jamás puede correr en modo demo
  if (
    process.env.APP_ENV === "production" &&
    process.env.FARO_DEMO_MODE === "true"
  ) {
    throw new Error("INVALID_ENV: FARO_DEMO_MODE cannot be true in production");
  }
}

# Crear tag anotado con mensaje
git tag -a v0.2.0-staging -m "FARO staging demo release · dataset Empresa Demo Cuyo S.A."

# Publicar tag a remoto
git push origin v0.2.0-staging

# Listar tags
git tag -l "v*" --sort=-version:refname

{
  "version": "0.2.0-staging",
  "commit_sha": "abc123def456",
  "branch": "main",
  "environment": "staging",
  "deployed_by": "github-actions",
  "deployed_at": "2026-05-31T18:00:00-03:00",
  "migration_version": "V001-V113",
  "score_model": "FARO_SCORE_MVP v1",
  "ai_prompts": ["AI-EXPLAIN-SCORE v1"],
  "demo_dataset": "EMP-DEMO v1",
  "catalogs": {
    "tensions": "TNS_CANONICAL v1",
    "actions": "ACT_CANONICAL v1",
    "evidence": "EVD_CANONICAL v1",
    "rules": "rules_mvp_v1"
  }
}

-- ============================================================
-- FARO-DEPLOY-001 · V110__create_ops_releases.sql
-- Catálogo de releases FARO
-- ============================================================

CREATE SCHEMA IF NOT EXISTS ops;

CREATE TABLE IF NOT EXISTS ops.releases (
  release_id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),

  version               text NOT NULL,
  environment           text NOT NULL CHECK (
    environment IN ('local', 'dev', 'staging', 'demo', 'production')
  ),

  commit_sha            text NOT NULL,
  branch_name           text NOT NULL,

  release_title         text NOT NULL,
  release_notes         text NULL,

  migration_from        text NULL,
  migration_to          text NULL,

  score_model_version   text NULL,
  ai_prompt_versions    jsonb NOT NULL DEFAULT '[]'::jsonb,

  demo_dataset_version  text NULL,

  status                text NOT NULL DEFAULT 'created' CHECK (
    status IN ('created', 'deployed', 'failed', 'rolled_back', 'cancelled')
  ),

  created_by            text NULL,
  deployed_by           text NULL,

  created_at            timestamptz NOT NULL DEFAULT now(),
  deployed_at           timestamptz NULL,
  rolled_back_at        timestamptz NULL,

  metadata              jsonb NOT NULL DEFAULT '{}'::jsonb,

  CONSTRAINT uq_releases_version_env UNIQUE (version, environment)
);

CREATE INDEX IF NOT EXISTS idx_releases_env_time
ON ops.releases (environment, created_at DESC);

CREATE INDEX IF NOT EXISTS idx_releases_status
ON ops.releases (environment, status, created_at DESC);

COMMENT ON TABLE ops.releases IS
'Catálogo de releases FARO. Una release = intención de desplegar versión X en ambiente Y.';

-- ============================================================
-- FARO-DEPLOY-001 · V111__create_ops_deployments.sql
-- Deployments individuales por proceso
-- ============================================================

CREATE TABLE IF NOT EXISTS ops.deployments (
  deployment_id     uuid PRIMARY KEY DEFAULT gen_random_uuid(),

  release_id        uuid NULL REFERENCES ops.releases(release_id),

  environment       text NOT NULL CHECK (
    environment IN ('dev', 'staging', 'demo', 'production')
  ),

  provider          text NOT NULL,            -- vercel, render, railway
  service_name      text NOT NULL,            -- web, worker, scheduler

  status            text NOT NULL CHECK (
    status IN (
      'pending',
      'building',
      'migrating',
      'deploying',
      'smoke_testing',
      'success',
      'failed',
      'rolled_back'
    )
  ),

  commit_sha        text NOT NULL,
  image_tag         text NULL,

  started_at        timestamptz NOT NULL DEFAULT now(),
  finished_at       timestamptz NULL,
  duration_ms       integer NULL,

  health_status     text NULL,             -- healthy, degraded, unhealthy
  smoke_status      text NULL,             -- passed, failed, skipped

  error_code        text NULL,
  error_message     text NULL,

  logs_url          text NULL,

  metadata          jsonb NOT NULL DEFAULT '{}'::jsonb
);

CREATE INDEX IF NOT EXISTS idx_deployments_env_time
ON ops.deployments (environment, started_at DESC);

CREATE INDEX IF NOT EXISTS idx_deployments_status
ON ops.deployments (environment, status, started_at DESC);

CREATE INDEX IF NOT EXISTS idx_deployments_release
ON ops.deployments (release_id);

COMMENT ON TABLE ops.deployments IS
'Deployment individual por proceso (web/worker/scheduler) de una release.';

-- ============================================================
-- FARO-DEPLOY-001 · V112__create_ops_release_backups.sql
-- Backups pre-release para auditoría y rollback
-- ============================================================

CREATE TABLE IF NOT EXISTS ops.release_backups (
  release_backup_id  uuid PRIMARY KEY DEFAULT gen_random_uuid(),

  release_id         uuid NULL REFERENCES ops.releases(release_id),
  environment        text NOT NULL,

  backup_type        text NOT NULL CHECK (
    backup_type IN ('database', 'storage', 'config')
  ),

  provider           text NOT NULL,         -- supabase, s3, manual
  backup_reference   text NOT NULL,         -- snapshot ID, URL, archivo

  status             text NOT NULL CHECK (
    status IN ('pending', 'success', 'failed')
  ),

  created_at         timestamptz NOT NULL DEFAULT now(),

  metadata           jsonb NOT NULL DEFAULT '{}'::jsonb
);

CREATE INDEX IF NOT EXISTS idx_release_backups_env_time
ON ops.release_backups (environment, created_at DESC);

CREATE INDEX IF NOT EXISTS idx_release_backups_release
ON ops.release_backups (release_id);

COMMENT ON TABLE ops.release_backups IS
'Backups pre-release con referencia al provider y status de validación.';

export async function createRelease(params: {
  client: any;
  version: string;
  environment: "dev" | "staging" | "demo" | "production";
  commitSha: string;
  branchName: string;
  releaseTitle: string;
  releaseNotes?: string;
}) {
  const result = await params.client.query(
    `
    INSERT INTO ops.releases (
      version,
      environment,
      commit_sha,
      branch_name,
      release_title,
      release_notes,
      status
    )
    VALUES ($1,$2,$3,$4,$5,$6,'created')
    RETURNING release_id
    `,
    [
      params.version,
      params.environment,
      params.commitSha,
      params.branchName,
      params.releaseTitle,
      params.releaseNotes ?? null
    ]
  );

  return result.rows[0].release_id;
}

export async function markReleaseDeployed(params: {
  client: any;
  releaseId: string;
  deployedBy: string;
}) {
  await params.client.query(
    `
    UPDATE ops.releases
    SET
      status = 'deployed',
      deployed_by = $2,
      deployed_at = now()
    WHERE release_id = $1
    `,
    [params.releaseId, params.deployedBy]
  );
}

{
  "scripts": {
    "dev": "next dev",
    "build": "next build",
    "start": "next start",
    "worker:start": "node dist/workers/runWorker.js",
    "scheduler:start": "node dist/workers/runScheduler.js",

    "db:migrate": "node scripts/db/migrate.ts",
    "db:migrate:test": "APP_ENV=test node scripts/db/migrate.ts",
    "db:seed:base": "node scripts/db/seed-base.ts",
    "db:seed:demo": "node scripts/db/seed-demo.ts",
    "db:seed:test": "node scripts/db/seed-test.ts",

    "test:unit": "vitest run",
    "test:sql": "node scripts/tests/run-sql-tests.ts",
    "test:api": "vitest run --config vitest.api.config.ts",
    "test:ui": "playwright test",
    "test:ci": "pnpm test:unit && pnpm test:sql && pnpm test:api",

    "qa:demo-check": "node scripts/qa/demo-check.ts",
    "lint": "eslint . --ext .ts,.tsx",
    "typecheck": "tsc --noEmit",

    "deploy:staging": "bash scripts/deploy/deploy-staging.sh",
    "deploy:demo": "bash scripts/deploy/deploy-demo.sh",
    "release:create": "node scripts/release/create-release.ts",
    "release:smoke": "node scripts/release/smoke-test.ts",
    "ops:backup:pre-release": "node scripts/ops/backup-pre-release.ts",
    "ops:workers:pause": "node scripts/ops/workers-pause.ts",
    "ops:workers:resume": "node scripts/ops/workers-resume.ts"
  }
}

FROM node:20-alpine AS base

WORKDIR /app

RUN corepack enable

COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile

COPY . .

RUN pnpm build

EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/api/health || exit 1

CMD ["pnpm", "start"]

FROM node:20-alpine AS worker

WORKDIR /app

RUN corepack enable

COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile

COPY . .

RUN pnpm build

CMD ["pnpm", "worker:start"]

export async function runSmokeTest(params: {
  baseUrl: string;
  email: string;
  password: string;
}) {
  // 1. Liveness
  const health = await fetch(`${params.baseUrl}/api/health`);
  if (!health.ok) {
    throw new Error("HEALTH_CHECK_FAILED");
  }

  // 2. Readiness (DB + Redis)
  const deep = await fetch(`${params.baseUrl}/api/health/deep`);
  if (!deep.ok) {
    throw new Error("DEEP_HEALTH_CHECK_FAILED");
  }

  // 3-10. Login demo + dashboard + score + reporte + worker job
  // (implementación completa: ver scripts/release/smoke-test.ts)

  return {
    ok: true,
    checks_passed: 10,
    duration_ms: 4200
  };
}

#!/usr/bin/env bash
# Rollback FARO a versión previa con pausa de workers + smoke test
set -euo pipefail

VERSION_PREVIOUS="$1"
ENVIRONMENT="$2"

echo "Rolling back FARO ${ENVIRONMENT} to ${VERSION_PREVIOUS}"

# 1. Pausar workers para evitar efectos duplicados
echo "Pausing workers..."
pnpm ops:workers:pause --env "$ENVIRONMENT"

# 2. Deployar versión anterior
echo "Deploying previous version..."
pnpm provider:deploy --version "$VERSION_PREVIOUS" --env "$ENVIRONMENT"

# 3. Smoke test contra versión recuperada
echo "Running smoke test..."
pnpm release:smoke --env "$ENVIRONMENT"

# 4. Reanudar workers
echo "Resuming workers..."
pnpm ops:workers:resume --env "$ENVIRONMENT"

# 5. Marcar release como rolled_back en ops.releases
pnpm release:mark-rolled-back --version "$VERSION_PREVIOUS" --env "$ENVIRONMENT"

echo "Rollback completed"

export function assertDemoSeedAllowed() {
  const appEnv = process.env.APP_ENV;
  const demoMode = process.env.FARO_DEMO_MODE;

  if (appEnv === "production" || demoMode !== "true") {
    throw new Error(
      "DEMO_SEED_NOT_ALLOWED: demo seeds require FARO_DEMO_MODE=true and non-production environment"
    );
  }
}

// Uso en scripts/db/seed-demo.ts
import { assertDemoSeedAllowed } from "./seed-demo-guard";

assertDemoSeedAllowed();  // aborta si no corresponde

// ... resto del seed Empresa Demo Cuyo S.A.