@geekmidas/cli 10.0.0-alpha.66 → 10.0.0-alpha.67

package/dist/{engine-DR6KurWX.cjs → engine-Cx_dvx9q.cjs}

@@ -1,197 +1,19 @@
-const require_local = require("./local-BdH4XN0E.cjs");
-const require_credentials = require("./credentials-Bzbg23n8.cjs");
+const require_credentials = require("./credentials-BVs7mrtw.cjs");
 const require_schemas = require("./schemas-RUlKHu27.cjs");
 const require_discover = require("./discover-OEfZ9OkA.cjs");
 const require_sandbox = require("./sandbox-CL--ZDui.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_workspace = require("./workspace-ON-bqiJz.cjs");
-const require_state = require("./state-Y6ATakMX.cjs");
-const require_sniffer = require("./sniffer-5xmrkh2a.cjs");
+const require_state = require("./state-DgmM4EKq.cjs");
+const require_sniffer = require("./sniffer-D66HIvi9.cjs");
 const require_provider = require("./provider-B3Sv_a74.cjs");
 let node_path = require("node:path");
-let node_fs_promises = require("node:fs/promises");
-let node_os = require("node:os");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let node_crypto = require("node:crypto");
 let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let pg = require("pg");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
 let node_dns_promises = require("node:dns/promises");
-//#region src/deploy/docker.ts
-const logger$3 = require_discover.output;
-/**
-* The id the Dockerfile templates mount the encrypted credentials under:
-* `RUN --mount=type=secret,id=gkm_credentials`.
-*/
-const CREDENTIALS_SECRET_ID = "gkm_credentials";
-/**
-* Get the full image reference
-*/
-function getImageRef(registry, imageName, tag) {
-	if (registry) return `${registry}/${imageName}:${tag}`;
-	return `${imageName}:${tag}`;
-}
-/**
-* The `docker build` argv for an image.
-*
-* One element per value, so nothing in a ref or a build arg is read by a
-* shell, and `--opt=value` rather than `--opt value`, so a value that starts
-* with `-` cannot be taken for one of docker's own flags.
-*
-* @internal Exported for testing
-*/
-function dockerBuildArgs(options) {
-	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
-	return [
-		"build",
-		"--platform=linux/amd64",
-		`--file=${dockerfilePath}`,
-		`--tag=${imageRef}`,
-		...buildArgs.map((arg) => `--build-arg=${arg}`),
-		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
-		"."
-	];
-}
-/**
-* Write the encrypted credentials where `docker build --secret` reads them.
-*
-* Two lines — ciphertext, then IV — so a template can split them with `sed`
-* in any base image. Owner-only, in a directory of its own, and the returned
-* cleanup removes both whatever the build did.
-*
-* @internal Exported for testing
-*/
-async function writeCredentialsFile(credentials) {
-	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "gkm-credentials-"));
-	const path = (0, node_path.join)(dir, CREDENTIALS_SECRET_ID);
-	await (0, node_fs_promises.writeFile)(path, `${credentials.encrypted}\n${credentials.iv}\n`, { mode: 384 });
-	await (0, node_fs_promises.chmod)(path, 384);
-	return {
-		path,
-		cleanup: () => (0, node_fs_promises.rm)(dir, {
-			recursive: true,
-			force: true
-		})
-	};
-}
-/**
-* Build Docker image
-* @param imageRef - Full image reference (registry/name:tag)
-* @param buildArgs - Build arguments to pass to docker build
-* @param credentials - Encrypted credentials, passed as a build secret
-*/
-async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
-	logger$3.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger$3.log("   Generating Dockerfile...");
-	await require_state.dockerCommand({
-		slim: true,
-		cwd
-	});
-	const dockerfilePath = dockerfile;
-	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
-	try {
-		await require_local.run("docker", dockerBuildArgs({
-			dockerfilePath,
-			imageRef,
-			buildArgs,
-			credentialsFile: secret?.path
-		}), {
-			cwd,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			},
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger$3.log(`✅ Image built: ${imageRef}`);
-	} catch (error) {
-		throw new require_state.DockerBuildFailed(imageRef, error);
-	} finally {
-		await secret?.cleanup();
-	}
-}
-/**
-* Push Docker image to registry
-*/
-async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger$3.log(`\n☁️  Pushing image: ${imageRef}`);
-	try {
-		await require_local.run("docker", ["push", imageRef], {
-			cwd,
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger$3.log(`✅ Image pushed: ${imageRef}`);
-	} catch (error) {
-		throw new require_state.DockerPushFailed(imageRef, error);
-	}
-}
-/**
-* The digest the registry gave a pushed image, `sha256:…`.
-*
-* A tag can be pushed over — by the next deploy, or by anything else that
-* shares the repository — and the digest is what says which image a stage
-* actually ran. `RepoDigests` has one entry per repository the image was
-* pushed to, so the one for this ref's repository is picked by name.
-*
-* @internal Exported for testing
-*/
-async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
-	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	const output = await require_local.runOutput("docker", [
-		"image",
-		"inspect",
-		"--format={{json .RepoDigests}}",
-		imageRef
-	], {
-		cwd,
-		...signal ? { signal } : {}
-	});
-	let digests;
-	try {
-		digests = JSON.parse(output.trim() || "[]");
-	} catch {
-		return;
-	}
-	if (!Array.isArray(digests)) return void 0;
-	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
-}
-/**
-* Deploy using Docker (build and optionally push image)
-*/
-async function deployDocker(options) {
-	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
-	const imageName = config.imageName;
-	const imageRef = require_state.validateImageRef(getImageRef(config.registry, imageName, tag));
-	const cwd = options.cwd ?? process.cwd();
-	const docker = {
-		cwd,
-		dockerfile: (0, node_path.join)(cwd, require_state.dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
-		...options.signal ? { signal: options.signal } : {},
-		...options.stdio ? { stdio: options.stdio } : {}
-	};
-	await buildImage(imageRef, buildArgs, credentials, docker);
-	let digest;
-	if (!skipPush) {
-		if (!config.registry) logger$3.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
-		else {
-			await pushImage(imageRef, docker);
-			digest = await pushedDigest(imageRef, docker);
-		}
-	}
-	logger$3.log("\n✅ Docker deployment ready!");
-	logger$3.log(`\n📋 Deployment details:`);
-	logger$3.log(`   Image: ${imageRef}`);
-	logger$3.log(`   Stage: ${stage}`);
-	if (masterKey) logger$3.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${require_sniffer.keyFingerprint(masterKey)}.`);
-	return {
-		imageRef,
-		...digest ? { digest } : {},
-		masterKey
-	};
-}
-//#endregion
 //#region src/deploy/ownership.ts
 /**
 * Which Dokploy project a deploy is allowed to deploy into.
@@ -439,7 +261,7 @@ function filterSecretsForApp(stageSecrets, sniffedEnv) {
 * @returns Encrypted payload with master key
 */
 function encryptSecretsForApp(filteredSecrets) {
-	const payload = require_sniffer.encryptSecrets(filteredSecrets.secrets);
+	const payload = require_state.encryptSecrets(filteredSecrets.secrets);
 	return {
 		appName: filteredSecrets.appName,
 		payload,
@@ -1273,7 +1095,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-BznqRC2S.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-dxkwynSs.cjs"));
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -1841,7 +1663,7 @@ const answer = require_schemas.discriminatedUnion("reason", [require_schemas.obj
 })]);
 /** Apply every pending migration, in the sandbox, as each construct's owner. */
 async function runMigrations(options) {
-	const sandbox = options.sandbox ?? require_sandbox.activeSandbox() ?? new require_local.LocalSandbox({ root: options.root });
+	const sandbox = options.sandbox ?? require_sandbox.activeSandbox() ?? new require_credentials.LocalSandbox({ root: options.root });
 	const { value } = await require_discover.runWorker(sandbox, "migrations", {
 		name: "migrate-worker",
 		args: [JSON.stringify({
@@ -2535,7 +2357,7 @@ async function releaseDokploy(run) {
 				if (appSecrets && credentials) logger.log(`      Encrypted ${appSecrets.secretCount} secrets`);
 				const imageRef$1 = require_state.imageRef(identity, appName, registry, imageTag);
 				logger.log(`      Building Docker image: ${imageRef$1}`);
-				const image = await deployDocker({
+				const image = await require_state.deployDocker({
 					stage,
 					tag: imageTag,
 					skipPush: false,
@@ -2644,7 +2466,7 @@ async function releaseDokploy(run) {
 				if (buildArgs.length > 0) logger.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
 				const imageRef$2 = require_state.imageRef(identity, appName, registry, imageTag);
 				logger.log(`      Building Docker image: ${imageRef$2}`);
-				const image = await deployDocker({
+				const image = await require_state.deployDocker({
 					stage,
 					tag: imageTag,
 					skipPush: false,
@@ -3276,4 +3098,4 @@ Object.defineProperty(exports, "verifySettings", {
 	}
 });
 
-//# sourceMappingURL=engine-DR6KurWX.cjs.map
+//# sourceMappingURL=engine-Cx_dvx9q.cjs.map