@geekmidas/cli 10.0.0-alpha.66 → 10.0.0-alpha.68

package/dist/{engine-DR6KurWX.cjs → engine-BM9Dy_DT.cjs}

@@ -1,197 +1,19 @@
-const require_local = require("./local-BdH4XN0E.cjs");
-const require_credentials = require("./credentials-Bzbg23n8.cjs");
+const require_credentials = require("./credentials-BVs7mrtw.cjs");
 const require_schemas = require("./schemas-RUlKHu27.cjs");
 const require_discover = require("./discover-OEfZ9OkA.cjs");
 const require_sandbox = require("./sandbox-CL--ZDui.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_workspace = require("./workspace-ON-bqiJz.cjs");
-const require_state = require("./state-Y6ATakMX.cjs");
-const require_sniffer = require("./sniffer-5xmrkh2a.cjs");
+const require_state = require("./state-CHZqCDRC.cjs");
+const require_sniffer = require("./sniffer-D66HIvi9.cjs");
 const require_provider = require("./provider-B3Sv_a74.cjs");
 let node_path = require("node:path");
-let node_fs_promises = require("node:fs/promises");
-let node_os = require("node:os");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let node_crypto = require("node:crypto");
 let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let pg = require("pg");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
 let node_dns_promises = require("node:dns/promises");
-//#region src/deploy/docker.ts
-const logger$3 = require_discover.output;
-/**
-* The id the Dockerfile templates mount the encrypted credentials under:
-* `RUN --mount=type=secret,id=gkm_credentials`.
-*/
-const CREDENTIALS_SECRET_ID = "gkm_credentials";
-/**
-* Get the full image reference
-*/
-function getImageRef(registry, imageName, tag) {
-	if (registry) return `${registry}/${imageName}:${tag}`;
-	return `${imageName}:${tag}`;
-}
-/**
-* The `docker build` argv for an image.
-*
-* One element per value, so nothing in a ref or a build arg is read by a
-* shell, and `--opt=value` rather than `--opt value`, so a value that starts
-* with `-` cannot be taken for one of docker's own flags.
-*
-* @internal Exported for testing
-*/
-function dockerBuildArgs(options) {
-	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
-	return [
-		"build",
-		"--platform=linux/amd64",
-		`--file=${dockerfilePath}`,
-		`--tag=${imageRef}`,
-		...buildArgs.map((arg) => `--build-arg=${arg}`),
-		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
-		"."
-	];
-}
-/**
-* Write the encrypted credentials where `docker build --secret` reads them.
-*
-* Two lines — ciphertext, then IV — so a template can split them with `sed`
-* in any base image. Owner-only, in a directory of its own, and the returned
-* cleanup removes both whatever the build did.
-*
-* @internal Exported for testing
-*/
-async function writeCredentialsFile(credentials) {
-	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "gkm-credentials-"));
-	const path = (0, node_path.join)(dir, CREDENTIALS_SECRET_ID);
-	await (0, node_fs_promises.writeFile)(path, `${credentials.encrypted}\n${credentials.iv}\n`, { mode: 384 });
-	await (0, node_fs_promises.chmod)(path, 384);
-	return {
-		path,
-		cleanup: () => (0, node_fs_promises.rm)(dir, {
-			recursive: true,
-			force: true
-		})
-	};
-}
-/**
-* Build Docker image
-* @param imageRef - Full image reference (registry/name:tag)
-* @param buildArgs - Build arguments to pass to docker build
-* @param credentials - Encrypted credentials, passed as a build secret
-*/
-async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
-	logger$3.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger$3.log("   Generating Dockerfile...");
-	await require_state.dockerCommand({
-		slim: true,
-		cwd
-	});
-	const dockerfilePath = dockerfile;
-	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
-	try {
-		await require_local.run("docker", dockerBuildArgs({
-			dockerfilePath,
-			imageRef,
-			buildArgs,
-			credentialsFile: secret?.path
-		}), {
-			cwd,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			},
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger$3.log(`✅ Image built: ${imageRef}`);
-	} catch (error) {
-		throw new require_state.DockerBuildFailed(imageRef, error);
-	} finally {
-		await secret?.cleanup();
-	}
-}
-/**
-* Push Docker image to registry
-*/
-async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger$3.log(`\n☁️  Pushing image: ${imageRef}`);
-	try {
-		await require_local.run("docker", ["push", imageRef], {
-			cwd,
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger$3.log(`✅ Image pushed: ${imageRef}`);
-	} catch (error) {
-		throw new require_state.DockerPushFailed(imageRef, error);
-	}
-}
-/**
-* The digest the registry gave a pushed image, `sha256:…`.
-*
-* A tag can be pushed over — by the next deploy, or by anything else that
-* shares the repository — and the digest is what says which image a stage
-* actually ran. `RepoDigests` has one entry per repository the image was
-* pushed to, so the one for this ref's repository is picked by name.
-*
-* @internal Exported for testing
-*/
-async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
-	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	const output = await require_local.runOutput("docker", [
-		"image",
-		"inspect",
-		"--format={{json .RepoDigests}}",
-		imageRef
-	], {
-		cwd,
-		...signal ? { signal } : {}
-	});
-	let digests;
-	try {
-		digests = JSON.parse(output.trim() || "[]");
-	} catch {
-		return;
-	}
-	if (!Array.isArray(digests)) return void 0;
-	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
-}
-/**
-* Deploy using Docker (build and optionally push image)
-*/
-async function deployDocker(options) {
-	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
-	const imageName = config.imageName;
-	const imageRef = require_state.validateImageRef(getImageRef(config.registry, imageName, tag));
-	const cwd = options.cwd ?? process.cwd();
-	const docker = {
-		cwd,
-		dockerfile: (0, node_path.join)(cwd, require_state.dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
-		...options.signal ? { signal: options.signal } : {},
-		...options.stdio ? { stdio: options.stdio } : {}
-	};
-	await buildImage(imageRef, buildArgs, credentials, docker);
-	let digest;
-	if (!skipPush) {
-		if (!config.registry) logger$3.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
-		else {
-			await pushImage(imageRef, docker);
-			digest = await pushedDigest(imageRef, docker);
-		}
-	}
-	logger$3.log("\n✅ Docker deployment ready!");
-	logger$3.log(`\n📋 Deployment details:`);
-	logger$3.log(`   Image: ${imageRef}`);
-	logger$3.log(`   Stage: ${stage}`);
-	if (masterKey) logger$3.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${require_sniffer.keyFingerprint(masterKey)}.`);
-	return {
-		imageRef,
-		...digest ? { digest } : {},
-		masterKey
-	};
-}
-//#endregion
 //#region src/deploy/ownership.ts
 /**
 * Which Dokploy project a deploy is allowed to deploy into.
@@ -439,7 +261,7 @@ function filterSecretsForApp(stageSecrets, sniffedEnv) {
 * @returns Encrypted payload with master key
 */
 function encryptSecretsForApp(filteredSecrets) {
-	const payload = require_sniffer.encryptSecrets(filteredSecrets.secrets);
+	const payload = require_state.encryptSecrets(filteredSecrets.secrets);
 	return {
 		appName: filteredSecrets.appName,
 		payload,
@@ -685,34 +507,47 @@ const PROVISIONERS = {
 		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: url.toString() } };
 	},
 	/**
-	* A bucket, as a MinIO stack on the box.
+	* A bucket: the stage's own, or — allowed — a MinIO stack on the box.
+	*
+	* A deployed stage's bucket is an external one — S3, R2, any S3-compatible
+	* store — whose URL and key pair the stage's secrets hold. Only with
+	* `--allow-dev-services minio` does this target run MinIO for one, and
+	* then only for a bucket whose URL the stage did not set.
 	*
 	* Dokploy has first-class primitives for Postgres and Redis and none for
-	* object storage, so this is the one kind whose infrastructure this target
-	* *writes* rather than configures — a compose file with one service in it.
+	* object storage, so MinIO is the one kind whose infrastructure this
+	* target *writes* rather than configures — a compose file with one
+	* service in it.
 	*
 	* The service is named `cloudName(...)` like everything else, which is not
 	* cosmetic here: containers on `dokploy-network` resolve each other by
 	* service name, so the name is the address. Calling it `minio` would work
 	* for exactly one project on the box and then collide.
 	*
-	* `s3://` carries no credentials, deliberately — deployed on AWS the SDK
-	* reads them from an execution role, so a URL that embedded a key would be
-	* one more thing to rotate and leak. There is no role here, so the same
-	* chain reads `AWS_ACCESS_KEY_ID` beside the URL, exactly as it does
-	* locally.
+	* A stage's own bucket URL may carry a key scoped to that bucket
+	* (`s3://KEY:SECRET@bucket`), which the client signs with; the shared
+	* `AWS_ACCESS_KEY_ID` pair is passed beside it when the stage set one, for
+	* a bucket whose URL has none. The MinIO this provisions uses that pair —
+	* the stage's, or one derived for it.
 	*/
 	objects: async (declaration, context) => {
 		if (declaration.kind !== "objects") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "url");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: {
+			[key]: given,
+			...storageKeys(context.supplied)
+		} };
 		const backend = context.storage ?? "minio";
 		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
+		if (!context.devServices?.includes("minio")) throw notConfigured(declaration.id, "objects", context);
 		const service = serviceName({
 			stage: context.stage,
 			app: context.scope ?? context.project
 		}, declaration.id);
 		const bucket = require_state.resourceName(declaration.id, declaration.kind, context.stage);
-		const user = `${bucket}-root`;
-		const password = derivedPassword(context, `objects:${declaration.id}`);
+		const user = context.supplied?.AWS_ACCESS_KEY_ID ?? `${bucket}-root`;
+		const password = context.supplied?.AWS_SECRET_ACCESS_KEY ?? derivedPassword(context, `objects:${declaration.id}`);
 		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
 			service,
 			bucket,
@@ -721,33 +556,67 @@ const PROVISIONERS = {
 		}));
 		await context.api.deployCompose(compose.composeId);
 		return { provides: {
-			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: s3Url(service, bucket),
+			[key]: s3Url(service, bucket),
 			AWS_ACCESS_KEY_ID: user,
 			AWS_SECRET_ACCESS_KEY: password,
-			AWS_REGION: MINIO_REGION
+			AWS_REGION: context.supplied?.AWS_REGION ?? MINIO_REGION
 		} };
 	},
 	/**
 	* The address a bucket's objects are served on.
 	*
-	* Nothing is provisioned: Dokploy runs Traefik, so a second reverse proxy
-	* behind the first would terminate TLS twice — which is why the local
-	* target's Caddy has no equivalent here. What this resolves is the address,
-	* and the `open` prefixes are applied to the bucket rather than to an edge,
-	* so a policy is what makes them public wherever the bucket lives.
+	* The stage's own — a CDN, the bucket's domain — when its secrets hold
+	* one, which a bucket that is not MinIO's needs.
 	*
-	* Until a Traefik rule exists it answers on MinIO directly, path-style,
-	* which is honest about the shape it has today: the bucket is in the path
-	* rather than fronted by a host of its own.
+	* Over MinIO nothing is provisioned: Dokploy runs Traefik, so a second
+	* reverse proxy behind the first would terminate TLS twice — which is why
+	* the local target's Caddy has no equivalent here. What this resolves is
+	* the address, and the `open` prefixes are applied to the bucket rather
+	* than to an edge, so a policy is what makes them public wherever the
+	* bucket lives. Until a Traefik rule exists it answers on MinIO directly,
+	* path-style, which is honest about the shape it has today: the bucket is
+	* in the path rather than fronted by a host of its own.
 	*/
 	"file-server": async (declaration, context) => {
 		if (declaration.kind !== "file-server") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "url");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: { [key]: given } };
 		const parentUrl = context.provisioned[declaration.of]?.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")];
 		if (!parentUrl) throw new UnresolvedParent(declaration.id, declaration.of);
 		const endpoint = new URL(parentUrl).searchParams.get("endpoint");
 		const bucket = new URL(parentUrl).hostname;
 		if (!endpoint) throw new UnresolvedParent(declaration.id, declaration.of);
-		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: `${endpoint}/${bucket}` } };
+		return { provides: { [key]: `${endpoint}/${bucket}` } };
+	},
+	/**
+	* Mail: the stage's own SMTP server, or — allowed — Mailpit on the box.
+	*
+	* Every provider speaks SMTP, so the provider is whatever the stage's
+	* `<ID>_URL` names, with the address it sends from beside it. Only with
+	* `--allow-dev-services mailpit`, and only where the stage set no URL,
+	* does this run Mailpit — which catches every message and delivers none.
+	*/
+	email: async (declaration, context) => {
+		if (declaration.kind !== "email") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "url");
+		const from = (0, _geekmidas_manifest.provideKey)(declaration.id, "from");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: {
+			[key]: given,
+			[from]: supplied(declaration.id, from, context)
+		} };
+		if (!context.devServices?.includes("mailpit")) throw notConfigured(declaration.id, "email", context);
+		const service = serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id);
+		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, mailpitCompose(service));
+		await context.api.deployCompose(compose.composeId);
+		return { provides: {
+			[key]: `smtp://${service}:1025`,
+			[from]: context.supplied?.[from] ?? `noreply@${context.domain ?? "localhost"}`
+		} };
 	},
 	/**
 	* A topic, and below it a queue — the same broker either way.
@@ -985,6 +854,56 @@ function minioCompose(options) {
 		""
 	].join("\n");
 }
+/**
+* A one-service compose file for Mailpit, on `dokploy-network` so the apps
+* reach it by its service name. It accepts mail from anything on the network
+* and delivers none of it.
+*/
+function mailpitCompose(service) {
+	return [
+		"services:",
+		`  ${service}:`,
+		"    image: axllent/mailpit:latest",
+		"    environment:",
+		"      MP_SMTP_AUTH_ACCEPT_ANY: '1'",
+		"      MP_SMTP_AUTH_ALLOW_INSECURE: '1'",
+		"    networks:",
+		"      - dokploy-network",
+		"networks:",
+		"  dokploy-network:",
+		"    external: true",
+		""
+	].join("\n");
+}
+/**
+* The S3 client's shared keys the stage set, for a bucket that is its own —
+* none when it set none, since a bucket's URL may carry its own key.
+*/
+function storageKeys(values) {
+	const keys = {};
+	for (const key of [...require_state.STORAGE_KEY_PAIR, "AWS_REGION"]) {
+		const value = values?.[key];
+		if (value !== void 0) keys[key] = value;
+	}
+	return keys;
+}
+/**
+* The error for a bucket or mail the stage configured nothing for — what
+* `validate` already refused, should a provisioner be reached without it.
+*/
+function notConfigured(id, kind, context) {
+	const { missing } = require_state.externalServices({
+		stage: context.stage,
+		declarations: [{
+			id,
+			kind
+		}],
+		supplied: context.supplied ?? {},
+		allow: [],
+		...context.domain ? { domain: context.domain } : {}
+	});
+	return new require_state.ExternalServicesNotConfigured(context.stage, missing);
+}
 /** Whether anything reads through a reader on this construct. */
 function readsFrom(manifest, id) {
 	return Object.values(manifest).some((declaration) => declaration.kind === "database-reader" && declaration.of === id);
@@ -1173,6 +1092,8 @@ async function provisionDeclared(options) {
 		cache: require_state.cacheBackendFor(require_state.providerOf(workspace)),
 		events: require_state.eventsBackendFor(require_state.providerOf(workspace)),
 		storage: require_state.storageBackendFor(require_state.providerOf(workspace)),
+		...options.devServices ? { devServices: options.devServices } : {},
+		...workspace.deploy?.domains?.[options.stage] ? { domain: workspace.deploy.domains[options.stage] } : {},
 		addresses: surfaceAddresses(manifest, options.appUrls),
 		seed: options.seed,
 		...options.supplied ? { supplied: options.supplied } : {},
@@ -1273,7 +1194,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-BznqRC2S.cjs"));
+		const { HostingerProvider } = await Promise.resolve().then(() => require("./HostingerProvider-dxkwynSs.cjs"));
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -1841,7 +1762,7 @@ const answer = require_schemas.discriminatedUnion("reason", [require_schemas.obj
 })]);
 /** Apply every pending migration, in the sandbox, as each construct's owner. */
 async function runMigrations(options) {
-	const sandbox = options.sandbox ?? require_sandbox.activeSandbox() ?? new require_local.LocalSandbox({ root: options.root });
+	const sandbox = options.sandbox ?? require_sandbox.activeSandbox() ?? new require_credentials.LocalSandbox({ root: options.root });
 	const { value } = await require_discover.runWorker(sandbox, "migrations", {
 		name: "migrate-worker",
 		args: [JSON.stringify({
@@ -2164,8 +2085,18 @@ async function validateDokploy(phase) {
 		secrets: phase.secrets,
 		ctx
 	};
+	const stored = await phase.secrets.read();
+	const services = require_state.assertExternalServices({
+		stage,
+		declarations: require_state.manifestServiceDeclarations(phase.manifest),
+		supplied: stored?.custom ?? {},
+		allow: phase.allowDevServices,
+		...workspace.deploy?.domains?.[stage] ? { domain: workspace.deploy.domains[stage] } : {}
+	});
+	require_state.reportDevServices(phase, require_state.devServicesUsed(services));
 	return {
 		...run,
+		allowDevServices: phase.allowDevServices,
 		preflight: await preflight(run),
 		verify: verifySettings(workspace.deploy.dokploy?.verify),
 		atomic: phase.atomic,
@@ -2345,7 +2276,8 @@ async function provision(run) {
 			appUrls,
 			supplied: stageSecrets.custom,
 			seed: stageSecrets.seed,
-			manifest
+			manifest,
+			devServices: run.allowDevServices
 		});
 		declaredEnv = declared.env;
 		declaredClusters = declared.clusters;
@@ -2535,7 +2467,7 @@ async function releaseDokploy(run) {
 				if (appSecrets && credentials) logger.log(`      Encrypted ${appSecrets.secretCount} secrets`);
 				const imageRef$1 = require_state.imageRef(identity, appName, registry, imageTag);
 				logger.log(`      Building Docker image: ${imageRef$1}`);
-				const image = await deployDocker({
+				const image = await require_state.deployDocker({
 					stage,
 					tag: imageTag,
 					skipPush: false,
@@ -2644,7 +2576,7 @@ async function releaseDokploy(run) {
 				if (buildArgs.length > 0) logger.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
 				const imageRef$2 = require_state.imageRef(identity, appName, registry, imageTag);
 				logger.log(`      Building Docker image: ${imageRef$2}`);
-				const image = await deployDocker({
+				const image = await require_state.deployDocker({
 					stage,
 					tag: imageTag,
 					skipPush: false,
@@ -3276,4 +3208,4 @@ Object.defineProperty(exports, "verifySettings", {
 	}
 });
 
-//# sourceMappingURL=engine-DR6KurWX.cjs.map
+//# sourceMappingURL=engine-BM9Dy_DT.cjs.map