@geekmidas/cli 10.0.0-alpha.60 → 10.0.0-alpha.61

package/dist/{deploy-0fBVeWO-.cjs → deploy-BbJdgQ2b.cjs}

@@ -1,4 +1,4 @@
-const require_sniffer = require("./sniffer-DIv12ncU.cjs");
+const require_sniffer = require("./sniffer-CQmJnNJM.cjs");
 const require_home = require("./home-DOzBaWaL.cjs");
 const require_discover = require("./discover-Bc-4eA_p.cjs");
 const require_config = require("./config-DXnkCEq0.cjs");
@@ -10,7 +10,6 @@ let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let node_crypto = require("node:crypto");
-let _geekmidas_constructs_encryption = require("@geekmidas/constructs/encryption");
 let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let pg = require("pg");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
@@ -855,108 +854,6 @@ function surfaceAddresses(manifest, appUrls) {
 	return addresses;
 }
 //#endregion
-//#region src/deploy/state.ts
-/**
-* Deploy state management for Dokploy deployments
-*
-* Stores resource IDs (applications, services) per stage to avoid
-* re-creating resources on subsequent deploys.
-*/
-/**
-* Create a new empty state for a stage
-*/
-function createEmptyState(stage, projectId, environmentId) {
-	return {
-		provider: "dokploy",
-		stage,
-		projectId,
-		environmentId,
-		applications: {},
-		services: {},
-		lastDeployedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Set application ID in state (mutates state)
-*/
-function setApplicationId(state, appName, applicationId) {
-	state.applications[appName] = applicationId;
-}
-/**
-* Record the image an app was deployed with (mutates state)
-*/
-function setDeployedImage(state, appName, image) {
-	state.images = {
-		...state.images,
-		[appName]: image
-	};
-}
-/**
-* Get a generated secret for an app
-*/
-function getGeneratedSecret(state, appName, secretName) {
-	return state?.generatedSecrets?.[appName]?.[secretName];
-}
-/**
-* Set a generated secret for an app (mutates state)
-*/
-function setGeneratedSecret(state, appName, secretName, value) {
-	if (!state.generatedSecrets) state.generatedSecrets = {};
-	if (!state.generatedSecrets[appName]) state.generatedSecrets[appName] = {};
-	state.generatedSecrets[appName][secretName] = value;
-}
-/**
-* Set DNS verification record for a hostname (mutates state)
-*/
-function setDnsVerification(state, hostname, serverIp) {
-	if (!state.dnsVerified) state.dnsVerified = {};
-	state.dnsVerified[hostname] = {
-		serverIp,
-		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Check if a hostname is already verified with the given IP
-*/
-function isDnsVerified(state, hostname, serverIp) {
-	return (state?.dnsVerified?.[hostname])?.serverIp === serverIp;
-}
-/**
-* Get the key for a DNS record in state
-*/
-function getDnsRecordKey(name, type) {
-	return `${name}:${type}`;
-}
-/**
-* Set a created DNS record in state (mutates state)
-*/
-function setDnsRecord(state, record) {
-	if (!state.dnsRecords) state.dnsRecords = {};
-	const key = getDnsRecordKey(record.name, record.type);
-	state.dnsRecords[key] = {
-		...record,
-		createdAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
-/**
-* Get backup state from state
-*/
-function getBackupState(state) {
-	return state?.backups;
-}
-/**
-* Set backup state (mutates state)
-*/
-function setBackupState(state, backupState) {
-	state.backups = backupState;
-}
-/**
-* Set postgres backup ID in state (mutates state)
-*/
-function setPostgresBackupId(state, backupId) {
-	if (state.backups) state.backups.postgresBackupId = backupId;
-}
-//#endregion
 //#region src/deploy/dns/DnsProvider.ts
 /**
 * Check if value is a DnsProvider implementation.
@@ -978,7 +875,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-BTZd2u0f.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-CgDaD8VR.cjs"));
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -1248,7 +1145,7 @@ async function orchestrateDns(appHostnames, dnsConfig, dokployEndpoint, state) {
 			hasFailures = true;
 		}
 		if (state) {
-			for (const record of domainRecords) if (record.created || record.existed) setDnsRecord(state, {
+			for (const record of domainRecords) if (record.created || record.existed) require_sniffer.setDnsRecord(state, {
 				domain: rootDomain,
 				name: record.subdomain,
 				type: record.type,
@@ -1283,7 +1180,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	const results = [];
 	logger$3.log("\n🔍 Verifying DNS records...");
 	for (const [appName, hostname] of appHostnames) {
-		if (isDnsVerified(state, hostname, serverIp)) {
+		if (require_sniffer.isDnsVerified(state, hostname, serverIp)) {
 			logger$3.log(`   ✓ ${hostname} (previously verified)`);
 			results.push({
 				hostname,
@@ -1297,7 +1194,7 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 		try {
 			const resolvedIp = await resolveHostnameToIp(hostname);
 			if (resolvedIp === serverIp) {
-				setDnsVerification(state, hostname, serverIp);
+				require_sniffer.setDnsVerification(state, hostname, serverIp);
 				logger$3.log(`   ✓ ${hostname} → ${resolvedIp}`);
 				results.push({
 					hostname,
@@ -1531,10 +1428,10 @@ function generateSecret() {
 * Otherwise generates a new one and stores it.
 */
 function getOrGenerateSecret(state, appName, secretName) {
-	const existing = getGeneratedSecret(state, appName, secretName);
+	const existing = require_sniffer.getGeneratedSecret(state, appName, secretName);
 	if (existing) return existing;
 	const generated = generateSecret();
-	setGeneratedSecret(state, appName, secretName, generated);
+	require_sniffer.setGeneratedSecret(state, appName, secretName, generated);
 	return generated;
 }
 /**
@@ -1597,57 +1494,6 @@ function validateEnvVars(requiredVars, context) {
 	};
 }
 //#endregion
-//#region src/deploy/generated.ts
-/**
-* The values a deployed stage generates once and keeps: what nothing can
-* provision and nobody else issues.
-*
-* - **A seed**, which salts every password a deploy derives — a database's
-*   master and roles, a bucket's root user. Derived from repo facts alone
-*   (project, stage, construct id), those passwords were computable by anyone
-*   who could read the repo.
-* - **Each `secret` construct's value** — an auth server's signing secret —
-*   random, rather than derived.
-* - **Each `encryption` construct's keyring** — one random key and an index
-*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
-*
-* Both are generated on the first deploy that needs them and written to the
-* stage's store, so every later deploy reads the same values: sessions survive
-* a redeploy, and a role's password does not move. A value set by hand with
-* `gkm secrets:set` is kept, never replaced.
-*/
-/**
-* The stage's secrets with its seed and every declared `secret`'s value
-* present, generating what is missing. Pure: the caller writes the result
-* back to the stage's store when `generated` is not empty.
-*/
-function withGeneratedSecrets(secrets, manifest) {
-	const generated = [];
-	const custom = { ...secrets.custom };
-	for (const declaration of Object.values(manifest)) {
-		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
-		const key = declaration.provides?.[0];
-		if (!key || custom[key]) continue;
-		custom[key] = declaration.kind === "encryption" ? (0, _geekmidas_constructs_encryption.generateKeyring)() : random();
-		generated.push(key);
-	}
-	const seed = secrets.seed ?? random();
-	if (!secrets.seed) generated.push("seed");
-	return {
-		secrets: generated.length ? {
-			...secrets,
-			seed,
-			custom,
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		} : secrets,
-		generated
-	};
-}
-/** 256 bits, URL-safe. */
-function random() {
-	return (0, node_crypto.randomBytes)(32).toString("base64url");
-}
-//#endregion
 //#region src/deploy/journal.ts
 var DeployJournal = class DeployJournal {
 	store;
@@ -2551,7 +2397,7 @@ async function preflight({ workspace, manifest, stage, ctx }) {
 	const secretsStore = await require_store.secretsStoreFor(workspace, stage, { ...ctx.home ? { home: ctx.home } : {} });
 	const stored = await secretsStore.read(stage);
 	if (!stored) logger.log(`   ⚠️  No secrets found for stage "${stage}"; starting them`);
-	const { secrets: stageSecrets, generated } = withGeneratedSecrets(stored ?? require_storage.initStageSecrets(stage), manifest);
+	const { secrets: stageSecrets, generated } = require_sniffer.withGeneratedSecrets(stored ?? require_storage.initStageSecrets(stage), manifest);
 	if (generated.length > 0) {
 		if (ctx.dryRun) logger.log(`   🔑 Would generate for "${stage}" (${secretsStore.name}): ${generated.join(", ")}`);
 		else {
@@ -2596,7 +2442,7 @@ async function deployLocked(run) {
 	});
 	const { api, endpoint } = await dokployApi(workspace, ctx);
 	logger.log("\n📋 Loading deploy state...");
-	const journal = await DeployJournal.open(store, stage, () => createEmptyState(stage, "", ""));
+	const journal = await DeployJournal.open(store, stage, () => require_sniffer.createEmptyState(stage, "", ""));
 	const state = journal.state;
 	if (journal.existed) logger.log(`   Found existing state for stage "${stage}"`);
 	else logger.log(`   Creating new state for stage "${stage}"`);
@@ -2728,15 +2574,15 @@ async function deployLocked(run) {
 			projectName: identity.scope,
 			stage,
 			config: workspace.deploy.backups,
-			existingState: getBackupState(state),
+			existingState: require_sniffer.getBackupState(state),
 			logger
 		});
-		setBackupState(state, backupState);
+		require_sniffer.setBackupState(state, backupState);
 		if (!backupState.postgresBackupId) {
 			const backupSchedule = workspace.deploy.backups.schedule ?? "0 2 * * *";
 			const backupRetention = workspace.deploy.backups.retention ?? 30;
 			logger.log("   Creating postgres backup schedule...");
-			setPostgresBackupId(state, (await api.createPostgresBackup({
+			const backup = await api.createPostgresBackup({
 				schedule: backupSchedule,
 				prefix: `${stage}/postgres`,
 				destinationId: backupState.destinationId,
@@ -2744,7 +2590,8 @@ async function deployLocked(run) {
 				postgresId: backupCluster.postgresId,
 				enabled: true,
 				keepLatestCount: backupRetention
-			})).backupId);
+			});
+			require_sniffer.setPostgresBackupId(state, backup.backupId);
 			logger.log(`   ✓ Postgres backup schedule created (${backupSchedule})`);
 		} else logger.log("   ✓ Using existing postgres backup schedule");
 	}
@@ -2792,7 +2639,7 @@ async function deployLocked(run) {
 	};
 	/** An image is pushed: worth keeping even if what follows fails. */
 	const built = async (appName, image, ref) => {
-		setDeployedImage(state, appName, {
+		require_sniffer.setDeployedImage(state, appName, {
 			ref: image.imageRef ?? ref,
 			...image.digest ? { digest: image.digest } : {}
 		});
@@ -3071,7 +2918,7 @@ async function ensureApplication(api, journal, appName, dokployAppName, projectI
 		action: via === "created" ? "create" : "reuse",
 		id: resource.applicationId
 	}, via);
-	setApplicationId(journal.state, appName, resource.applicationId);
+	require_sniffer.setApplicationId(journal.state, appName, resource.applicationId);
 	return resource;
 }
 /**
@@ -3515,4 +3362,4 @@ Object.defineProperty(exports, "terminalCredentials", {
 	}
 });
 
-//# sourceMappingURL=deploy-0fBVeWO-.cjs.map
+//# sourceMappingURL=deploy-BbJdgQ2b.cjs.map