@envsync-cloud/deploy 0.20.2 → 0.20.4

package/dist/cli.js

@@ -361,6 +361,7 @@ function buildRuntimeEnv2(config, generated, options) {
     ENVSYNC_EDITION: oss ? "oss" : "enterprise",
     // Self-host product install — never multi-tenant SaaS mode (program plan Phase 1).
     ENVSYNC_DEPLOYMENT_MODE: "selfhosted",
+    SKIP_ROOT_ENV: "1",
     ENVSYNC_MANAGEMENT_ENABLED: oss ? "false" : "true",
     // Landing is Hosted-only; self-host does not ship marketing/signup surface.
     ENVSYNC_LANDING_ENABLED: "false",
@@ -1144,6 +1145,12 @@ ${renderEnvList({
   })}
 ${apiLicenseVolume}
     networks: [envsync]
+    healthcheck:
+      test: ["CMD", "bun", "-e", "fetch('http://127.0.0.1:4000/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 10s
+      timeout: 5s
+      retries: 8
+      start_period: 45s
     deploy:
       replicas: ${slotHasApiDeployment(deployment.slots.blue) ? 1 : 0}
 
@@ -1157,6 +1164,12 @@ ${renderEnvList({
   })}
 ${apiLicenseVolume}
     networks: [envsync]
+    healthcheck:
+      test: ["CMD", "bun", "-e", "fetch('http://127.0.0.1:4000/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 10s
+      timeout: 5s
+      retries: 8
+      start_period: 45s
     deploy:
       replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}${netutilsService}${vpnResult?.serviceBlock ?? ""}
 
@@ -2883,7 +2896,7 @@ function createApiDbUpgradeBackup(config, fromVersion, toVersion) {
     "postgres:17",
     "sh",
     "-lc",
-    `pg_dump -h ${config.services.stack_name}_postgres -U postgres -d envsync -Fc -f /backup/${fileName}`
+    `pg_dump -h postgres -U postgres -d envsync -Fc -f /backup/${fileName}`
   ]);
   logSuccess(`API DB upgrade snapshot created at ${hostPath}`);
   return hostPath;
@@ -2907,7 +2920,7 @@ function restoreApiDbUpgradeBackup(config, backupPath) {
     "postgres:17",
     "sh",
     "-lc",
-    `pg_restore --clean --if-exists --no-owner --no-privileges -h ${config.services.stack_name}_postgres -U postgres -d envsync /backup/${fileName}`
+    `pg_restore --clean --if-exists --no-owner --no-privileges -h postgres -U postgres -d envsync /backup/${fileName}`
   ]);
   logSuccess(`API DB upgrade snapshot restored from ${backupPath}`);
 }
@@ -3275,6 +3288,7 @@ function runApiMigrationJsonCommand(config, image, args) {
       executedMigrations: []
     };
   }
+  const migrateCli = args.map((arg) => JSON.stringify(arg)).join(" ");
   const output = run(
     "docker",
     [
@@ -3287,11 +3301,14 @@ function runApiMigrationJsonCommand(config, image, args) {
       "-e",
       "SKIP_ROOT_ENV=1",
       image,
-      "bun",
-      "run",
-      "scripts/migrate.ts",
-      ...args,
-      "--json"
+      "sh",
+      "-lc",
+      [
+        "if [ -d /app/packages/envsync-api ]; then cd /app/packages/envsync-api; fi",
+        `if [ -f scripts/migrate.enterprise.ts ]; then exec bun run scripts/migrate.enterprise.ts ${migrateCli} --json`,
+        `elif [ -f scripts/migrate.ts ]; then exec bun run scripts/migrate.ts ${migrateCli} --json`,
+        "else echo 'Migration CLI missing from API image (expected scripts/migrate.ts)' >&2; exit 1; fi"
+      ].join("; ")
     ],
     { quiet: true }
   );
@@ -3630,7 +3647,15 @@ function waitForApiSlotHealthy(config, slot, timeoutSeconds = 180) {
     sleepSeconds(3);
   }
   const services = listStackServices(config);
-  throw new Error(`Timed out waiting for API ${slot} slot to become healthy: ${serviceHealth(services, serviceName)}`);
+  const ps = tryRun("docker", ["service", "ps", serviceName, "--no-trunc", "--format", "{{.CurrentState}} {{.Error}}"], {
+    quiet: true
+  });
+  const logs = tryRun("docker", ["service", "logs", "--tail", "80", serviceName], { quiet: true });
+  throw new Error(
+    `Timed out waiting for API ${slot} slot to become healthy: ${serviceHealth(services, serviceName)}
+${ps}
+${logs}`
+  );
 }
 function waitForHealthyServices(config, checks, timeoutSeconds = 180) {
   if (currentOptions.dryRun) {
@@ -4188,8 +4213,8 @@ async function cmdDeploy() {
   logSection("Deploy");
   const { config, generated } = loadState();
   logReleaseContext(config);
-  if (!isOssConfig2(config)) {
-    ensureEnterpriseLicenseFilesReadable();
+  if (!isOssConfig2(config) && !currentOptions.dryRun) {
+    await ensureEnterpriseCertificateBundle(config);
   }
   assertSwarmManager();
   assertBootstrapState(generated);
@@ -4255,7 +4280,12 @@ async function cmdDeploy() {
       const rollbackTarget = preUpgradeHead ?? "zero";
       try {
         logWarn(`Candidate deploy failed after migration. Rolling schema back to ${rollbackTarget}.`);
-        runApiMigrationJsonCommand(config, config.images.api, ["rollback_to", rollbackTarget]);
+        try {
+          runApiMigrationJsonCommand(config, config.images.api, ["rollback_to", rollbackTarget]);
+        } catch {
+          logWarn(`Rollback with ${config.images.api} failed; retrying with ${activeImageBeforeUpgrade}.`);
+          runApiMigrationJsonCommand(config, activeImageBeforeUpgrade, ["rollback_to", rollbackTarget]);
+        }
       } catch (rollbackError) {
         if (!snapshotPath) {
           throw new Error(
@@ -4564,7 +4594,7 @@ async function cmdUpgrade(targetVersion) {
   };
   logReleaseContext(config);
   if (!isOssConfig2(config) && !currentOptions.dryRun) {
-    ensureEnterpriseLicenseFilesReadable();
+    await ensureEnterpriseCertificateBundle(config);
   }
   config.images = {
     ...config.images,

package/dist/index.js

@@ -362,6 +362,7 @@ function buildRuntimeEnv2(config, generated, options) {
     ENVSYNC_EDITION: oss ? "oss" : "enterprise",
     // Self-host product install — never multi-tenant SaaS mode (program plan Phase 1).
     ENVSYNC_DEPLOYMENT_MODE: "selfhosted",
+    SKIP_ROOT_ENV: "1",
     ENVSYNC_MANAGEMENT_ENABLED: oss ? "false" : "true",
     // Landing is Hosted-only; self-host does not ship marketing/signup surface.
     ENVSYNC_LANDING_ENABLED: "false",
@@ -1141,6 +1142,12 @@ ${renderEnvList({
   })}
 ${apiLicenseVolume}
     networks: [envsync]
+    healthcheck:
+      test: ["CMD", "bun", "-e", "fetch('http://127.0.0.1:4000/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 10s
+      timeout: 5s
+      retries: 8
+      start_period: 45s
     deploy:
       replicas: ${slotHasApiDeployment(deployment.slots.blue) ? 1 : 0}
 
@@ -1154,6 +1161,12 @@ ${renderEnvList({
   })}
 ${apiLicenseVolume}
     networks: [envsync]
+    healthcheck:
+      test: ["CMD", "bun", "-e", "fetch('http://127.0.0.1:4000/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 10s
+      timeout: 5s
+      retries: 8
+      start_period: 45s
     deploy:
       replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}${netutilsService}${vpnResult?.serviceBlock ?? ""}
 
@@ -2745,7 +2758,7 @@ function createApiDbUpgradeBackup(config, fromVersion, toVersion) {
     "postgres:17",
     "sh",
     "-lc",
-    `pg_dump -h ${config.services.stack_name}_postgres -U postgres -d envsync -Fc -f /backup/${fileName}`
+    `pg_dump -h postgres -U postgres -d envsync -Fc -f /backup/${fileName}`
   ]);
   logSuccess(`API DB upgrade snapshot created at ${hostPath}`);
   return hostPath;
@@ -2769,7 +2782,7 @@ function restoreApiDbUpgradeBackup(config, backupPath) {
     "postgres:17",
     "sh",
     "-lc",
-    `pg_restore --clean --if-exists --no-owner --no-privileges -h ${config.services.stack_name}_postgres -U postgres -d envsync /backup/${fileName}`
+    `pg_restore --clean --if-exists --no-owner --no-privileges -h postgres -U postgres -d envsync /backup/${fileName}`
   ]);
   logSuccess(`API DB upgrade snapshot restored from ${backupPath}`);
 }
@@ -3137,6 +3150,7 @@ function runApiMigrationJsonCommand(config, image, args) {
       executedMigrations: []
     };
   }
+  const migrateCli = args.map((arg) => JSON.stringify(arg)).join(" ");
   const output = run(
     "docker",
     [
@@ -3149,11 +3163,14 @@ function runApiMigrationJsonCommand(config, image, args) {
       "-e",
       "SKIP_ROOT_ENV=1",
       image,
-      "bun",
-      "run",
-      "scripts/migrate.ts",
-      ...args,
-      "--json"
+      "sh",
+      "-lc",
+      [
+        "if [ -d /app/packages/envsync-api ]; then cd /app/packages/envsync-api; fi",
+        `if [ -f scripts/migrate.enterprise.ts ]; then exec bun run scripts/migrate.enterprise.ts ${migrateCli} --json`,
+        `elif [ -f scripts/migrate.ts ]; then exec bun run scripts/migrate.ts ${migrateCli} --json`,
+        "else echo 'Migration CLI missing from API image (expected scripts/migrate.ts)' >&2; exit 1; fi"
+      ].join("; ")
     ],
     { quiet: true }
   );
@@ -3492,7 +3509,15 @@ function waitForApiSlotHealthy(config, slot, timeoutSeconds = 180) {
     sleepSeconds(3);
   }
   const services = listStackServices(config);
-  throw new Error(`Timed out waiting for API ${slot} slot to become healthy: ${serviceHealth(services, serviceName)}`);
+  const ps = tryRun("docker", ["service", "ps", serviceName, "--no-trunc", "--format", "{{.CurrentState}} {{.Error}}"], {
+    quiet: true
+  });
+  const logs = tryRun("docker", ["service", "logs", "--tail", "80", serviceName], { quiet: true });
+  throw new Error(
+    `Timed out waiting for API ${slot} slot to become healthy: ${serviceHealth(services, serviceName)}
+${ps}
+${logs}`
+  );
 }
 function waitForHealthyServices(config, checks, timeoutSeconds = 180) {
   if (currentOptions.dryRun) {
@@ -4050,8 +4075,8 @@ async function cmdDeploy() {
   logSection("Deploy");
   const { config, generated } = loadState();
   logReleaseContext(config);
-  if (!isOssConfig2(config)) {
-    ensureEnterpriseLicenseFilesReadable();
+  if (!isOssConfig2(config) && !currentOptions.dryRun) {
+    await ensureEnterpriseCertificateBundle(config);
   }
   assertSwarmManager();
   assertBootstrapState(generated);
@@ -4117,7 +4142,12 @@ async function cmdDeploy() {
       const rollbackTarget = preUpgradeHead ?? "zero";
       try {
         logWarn(`Candidate deploy failed after migration. Rolling schema back to ${rollbackTarget}.`);
-        runApiMigrationJsonCommand(config, config.images.api, ["rollback_to", rollbackTarget]);
+        try {
+          runApiMigrationJsonCommand(config, config.images.api, ["rollback_to", rollbackTarget]);
+        } catch {
+          logWarn(`Rollback with ${config.images.api} failed; retrying with ${activeImageBeforeUpgrade}.`);
+          runApiMigrationJsonCommand(config, activeImageBeforeUpgrade, ["rollback_to", rollbackTarget]);
+        }
       } catch (rollbackError) {
         if (!snapshotPath) {
           throw new Error(
@@ -4426,7 +4456,7 @@ async function cmdUpgrade(targetVersion) {
   };
   logReleaseContext(config);
   if (!isOssConfig2(config) && !currentOptions.dryRun) {
-    ensureEnterpriseLicenseFilesReadable();
+    await ensureEnterpriseCertificateBundle(config);
   }
   config.images = {
     ...config.images,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy",
-  "version": "0.20.2",
+  "version": "0.20.4",
   "description": "OSS CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {
@@ -42,10 +42,11 @@
   ],
   "dependencies": {
     "chalk": "^5.6.2",
-    "yaml": "^1.10.2"
+    "yaml": "^1.10.2",
+    "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@envsync-cloud/deploy-core": "0.20.2",
+    "@envsync-cloud/deploy-core": "0.20.4",
     "tsup": "^8.5.0",
     "typescript": "^5.9.2"
   },