@geekmidas/cli 10.0.0-alpha.66 → 10.0.0-alpha.68

package/dist/{engine-CunvOG3s.mjs → engine-llWnMZH5.mjs}

@@ -1,197 +1,19 @@
-import { c as runOutput, s as run, t as LocalSandbox } from "./local-CWR4Y_kW.mjs";
-import { t as MissingCredential } from "./credentials-Dq1MnWQf.mjs";
+import { i as LocalSandbox, t as MissingCredential } from "./credentials-pAtB70k3.mjs";
 import { a as discriminatedUnion, d as string, l as object, n as array, o as literal, s as looseObject } from "./schemas-Cfhtpdo0.mjs";
 import { c as runWorker, d as output, r as discover } from "./discover-BFoJWKGD.mjs";
 import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { g as stripPublicPrefix, h as getPublicEnvPrefix, s as getAppBuildOrder } from "./workspace-Be6uBhlF.mjs";
-import { C as validateImageRef, Ct as markerOf, Et as initStageSecrets, J as cacheBackendFor, K as resourceName, O as constructGlobs, P as applyPostgres, St as isOwnedBy, T as resolveHost, Tt as projectName, V as dockerfileOf, X as providerOf, Y as eventsBackendFor, Z as storageBackendFor, a as recordRelease, bt as imageName, c as setBackupState, d as setGeneratedSecret, f as setPostgresBackupId, g as DockerPushFailed, h as DockerBuildFailed, i as isDnsVerified, kt as toEmbeddableSecrets, l as setDnsRecord, m as withGeneratedSecrets, n as getBackupState, o as recordRollback, p as DeployJournal, r as getGeneratedSecret, s as setApplicationId, t as createEmptyState, u as setDnsVerification, v as dockerCommand, vt as applicationName, w as isMainFrontendApp, wt as ownershipMarker, xt as imageRef } from "./state-uuYqnRVO.mjs";
-import { f as StateStoreBusy, m as StateVersionConflict, o as DokployApi, s as DokployApiError, t as sniffAllApps, v as eventError, x as keyFingerprint, y as encryptSecrets } from "./sniffer-BAQhLEsI.mjs";
+import { A as assertExternalServices, C as isMainFrontendApp, D as ExternalServicesNotConfigured, F as reportDevServices, Gt as ownershipMarker, Ht as imageRef, I as encryptSecrets, Kt as projectName, M as externalServices, N as manifestServiceDeclarations, O as STORAGE_KEY_PAIR, Ut as isOwnedBy, V as constructGlobs, Vt as imageName, Wt as markerOf, Xt as toEmbeddableSecrets, Y as applyPostgres, _ as deployDocker, _t as providerOf, a as recordRelease, c as setBackupState, ct as resourceName, d as setGeneratedSecret, f as setPostgresBackupId, gt as eventsBackendFor, ht as cacheBackendFor, i as isDnsVerified, j as devServicesUsed, l as setDnsRecord, m as withGeneratedSecrets, n as getBackupState, o as recordRollback, p as DeployJournal, qt as initStageSecrets, r as getGeneratedSecret, s as setApplicationId, t as createEmptyState, u as setDnsVerification, vt as storageBackendFor, w as resolveHost, zt as applicationName } from "./state-Bn5JDMFT.mjs";
+import { f as StateStoreBusy, m as StateVersionConflict, o as DokployApi, s as DokployApiError, t as sniffAllApps, v as eventError } from "./sniffer-BdFeLSmA.mjs";
 import { o as migrationFiles } from "./provider-D7rQzzzf.mjs";
 import { join } from "node:path";
-import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
 import { cacheTable, cloudName, cookieDomain, dependentsOf, externalApiUrl, migrationTargets, mobileOrigins, provideKey, provisionOrder, schemeBase } from "@geekmidas/manifest";
 import { createHash, randomBytes } from "node:crypto";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { Client } from "pg";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
 import { lookup } from "node:dns/promises";
-//#region src/deploy/docker.ts
-const logger$3 = output;
-/**
-* The id the Dockerfile templates mount the encrypted credentials under:
-* `RUN --mount=type=secret,id=gkm_credentials`.
-*/
-const CREDENTIALS_SECRET_ID = "gkm_credentials";
-/**
-* Get the full image reference
-*/
-function getImageRef(registry, imageName, tag) {
-	if (registry) return `${registry}/${imageName}:${tag}`;
-	return `${imageName}:${tag}`;
-}
-/**
-* The `docker build` argv for an image.
-*
-* One element per value, so nothing in a ref or a build arg is read by a
-* shell, and `--opt=value` rather than `--opt value`, so a value that starts
-* with `-` cannot be taken for one of docker's own flags.
-*
-* @internal Exported for testing
-*/
-function dockerBuildArgs(options) {
-	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
-	return [
-		"build",
-		"--platform=linux/amd64",
-		`--file=${dockerfilePath}`,
-		`--tag=${imageRef}`,
-		...buildArgs.map((arg) => `--build-arg=${arg}`),
-		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
-		"."
-	];
-}
-/**
-* Write the encrypted credentials where `docker build --secret` reads them.
-*
-* Two lines — ciphertext, then IV — so a template can split them with `sed`
-* in any base image. Owner-only, in a directory of its own, and the returned
-* cleanup removes both whatever the build did.
-*
-* @internal Exported for testing
-*/
-async function writeCredentialsFile(credentials) {
-	const dir = await mkdtemp(join(tmpdir(), "gkm-credentials-"));
-	const path = join(dir, CREDENTIALS_SECRET_ID);
-	await writeFile(path, `${credentials.encrypted}\n${credentials.iv}\n`, { mode: 384 });
-	await chmod(path, 384);
-	return {
-		path,
-		cleanup: () => rm(dir, {
-			recursive: true,
-			force: true
-		})
-	};
-}
-/**
-* Build Docker image
-* @param imageRef - Full image reference (registry/name:tag)
-* @param buildArgs - Build arguments to pass to docker build
-* @param credentials - Encrypted credentials, passed as a build secret
-*/
-async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
-	logger$3.log(`\n🔨 Building Docker image: ${imageRef}`);
-	logger$3.log("   Generating Dockerfile...");
-	await dockerCommand({
-		slim: true,
-		cwd
-	});
-	const dockerfilePath = dockerfile;
-	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
-	try {
-		await run("docker", dockerBuildArgs({
-			dockerfilePath,
-			imageRef,
-			buildArgs,
-			credentialsFile: secret?.path
-		}), {
-			cwd,
-			env: {
-				...process.env,
-				DOCKER_BUILDKIT: "1"
-			},
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger$3.log(`✅ Image built: ${imageRef}`);
-	} catch (error) {
-		throw new DockerBuildFailed(imageRef, error);
-	} finally {
-		await secret?.cleanup();
-	}
-}
-/**
-* Push Docker image to registry
-*/
-async function pushImage(imageRef, { cwd, signal, stdio }) {
-	logger$3.log(`\n☁️  Pushing image: ${imageRef}`);
-	try {
-		await run("docker", ["push", imageRef], {
-			cwd,
-			...signal ? { signal } : {},
-			...stdio ? { stdio } : {}
-		});
-		logger$3.log(`✅ Image pushed: ${imageRef}`);
-	} catch (error) {
-		throw new DockerPushFailed(imageRef, error);
-	}
-}
-/**
-* The digest the registry gave a pushed image, `sha256:…`.
-*
-* A tag can be pushed over — by the next deploy, or by anything else that
-* shares the repository — and the digest is what says which image a stage
-* actually ran. `RepoDigests` has one entry per repository the image was
-* pushed to, so the one for this ref's repository is picked by name.
-*
-* @internal Exported for testing
-*/
-async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
-	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
-	const output = await runOutput("docker", [
-		"image",
-		"inspect",
-		"--format={{json .RepoDigests}}",
-		imageRef
-	], {
-		cwd,
-		...signal ? { signal } : {}
-	});
-	let digests;
-	try {
-		digests = JSON.parse(output.trim() || "[]");
-	} catch {
-		return;
-	}
-	if (!Array.isArray(digests)) return void 0;
-	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
-}
-/**
-* Deploy using Docker (build and optionally push image)
-*/
-async function deployDocker(options) {
-	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
-	const imageName = config.imageName;
-	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
-	const cwd = options.cwd ?? process.cwd();
-	const docker = {
-		cwd,
-		dockerfile: join(cwd, dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
-		...options.signal ? { signal: options.signal } : {},
-		...options.stdio ? { stdio: options.stdio } : {}
-	};
-	await buildImage(imageRef, buildArgs, credentials, docker);
-	let digest;
-	if (!skipPush) {
-		if (!config.registry) logger$3.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
-		else {
-			await pushImage(imageRef, docker);
-			digest = await pushedDigest(imageRef, docker);
-		}
-	}
-	logger$3.log("\n✅ Docker deployment ready!");
-	logger$3.log(`\n📋 Deployment details:`);
-	logger$3.log(`   Image: ${imageRef}`);
-	logger$3.log(`   Stage: ${stage}`);
-	if (masterKey) logger$3.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
-	return {
-		imageRef,
-		...digest ? { digest } : {},
-		masterKey
-	};
-}
-//#endregion
 //#region src/deploy/ownership.ts
 /**
 * Which Dokploy project a deploy is allowed to deploy into.
@@ -685,34 +507,47 @@ const PROVISIONERS = {
 		return { provides: { [provideKey(declaration.id, "url")]: url.toString() } };
 	},
 	/**
-	* A bucket, as a MinIO stack on the box.
+	* A bucket: the stage's own, or — allowed — a MinIO stack on the box.
+	*
+	* A deployed stage's bucket is an external one — S3, R2, any S3-compatible
+	* store — whose URL and key pair the stage's secrets hold. Only with
+	* `--allow-dev-services minio` does this target run MinIO for one, and
+	* then only for a bucket whose URL the stage did not set.
 	*
 	* Dokploy has first-class primitives for Postgres and Redis and none for
-	* object storage, so this is the one kind whose infrastructure this target
-	* *writes* rather than configures — a compose file with one service in it.
+	* object storage, so MinIO is the one kind whose infrastructure this
+	* target *writes* rather than configures — a compose file with one
+	* service in it.
 	*
 	* The service is named `cloudName(...)` like everything else, which is not
 	* cosmetic here: containers on `dokploy-network` resolve each other by
 	* service name, so the name is the address. Calling it `minio` would work
 	* for exactly one project on the box and then collide.
 	*
-	* `s3://` carries no credentials, deliberately — deployed on AWS the SDK
-	* reads them from an execution role, so a URL that embedded a key would be
-	* one more thing to rotate and leak. There is no role here, so the same
-	* chain reads `AWS_ACCESS_KEY_ID` beside the URL, exactly as it does
-	* locally.
+	* A stage's own bucket URL may carry a key scoped to that bucket
+	* (`s3://KEY:SECRET@bucket`), which the client signs with; the shared
+	* `AWS_ACCESS_KEY_ID` pair is passed beside it when the stage set one, for
+	* a bucket whose URL has none. The MinIO this provisions uses that pair —
+	* the stage's, or one derived for it.
 	*/
 	objects: async (declaration, context) => {
 		if (declaration.kind !== "objects") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: {
+			[key]: given,
+			...storageKeys(context.supplied)
+		} };
 		const backend = context.storage ?? "minio";
 		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
+		if (!context.devServices?.includes("minio")) throw notConfigured(declaration.id, "objects", context);
 		const service = serviceName({
 			stage: context.stage,
 			app: context.scope ?? context.project
 		}, declaration.id);
 		const bucket = resourceName(declaration.id, declaration.kind, context.stage);
-		const user = `${bucket}-root`;
-		const password = derivedPassword(context, `objects:${declaration.id}`);
+		const user = context.supplied?.AWS_ACCESS_KEY_ID ?? `${bucket}-root`;
+		const password = context.supplied?.AWS_SECRET_ACCESS_KEY ?? derivedPassword(context, `objects:${declaration.id}`);
 		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
 			service,
 			bucket,
@@ -721,33 +556,67 @@ const PROVISIONERS = {
 		}));
 		await context.api.deployCompose(compose.composeId);
 		return { provides: {
-			[provideKey(declaration.id, "url")]: s3Url(service, bucket),
+			[key]: s3Url(service, bucket),
 			AWS_ACCESS_KEY_ID: user,
 			AWS_SECRET_ACCESS_KEY: password,
-			AWS_REGION: MINIO_REGION
+			AWS_REGION: context.supplied?.AWS_REGION ?? MINIO_REGION
 		} };
 	},
 	/**
 	* The address a bucket's objects are served on.
 	*
-	* Nothing is provisioned: Dokploy runs Traefik, so a second reverse proxy
-	* behind the first would terminate TLS twice — which is why the local
-	* target's Caddy has no equivalent here. What this resolves is the address,
-	* and the `open` prefixes are applied to the bucket rather than to an edge,
-	* so a policy is what makes them public wherever the bucket lives.
+	* The stage's own — a CDN, the bucket's domain — when its secrets hold
+	* one, which a bucket that is not MinIO's needs.
 	*
-	* Until a Traefik rule exists it answers on MinIO directly, path-style,
-	* which is honest about the shape it has today: the bucket is in the path
-	* rather than fronted by a host of its own.
+	* Over MinIO nothing is provisioned: Dokploy runs Traefik, so a second
+	* reverse proxy behind the first would terminate TLS twice — which is why
+	* the local target's Caddy has no equivalent here. What this resolves is
+	* the address, and the `open` prefixes are applied to the bucket rather
+	* than to an edge, so a policy is what makes them public wherever the
+	* bucket lives. Until a Traefik rule exists it answers on MinIO directly,
+	* path-style, which is honest about the shape it has today: the bucket is
+	* in the path rather than fronted by a host of its own.
 	*/
 	"file-server": async (declaration, context) => {
 		if (declaration.kind !== "file-server") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: { [key]: given } };
 		const parentUrl = context.provisioned[declaration.of]?.provides[provideKey(declaration.of, "url")];
 		if (!parentUrl) throw new UnresolvedParent(declaration.id, declaration.of);
 		const endpoint = new URL(parentUrl).searchParams.get("endpoint");
 		const bucket = new URL(parentUrl).hostname;
 		if (!endpoint) throw new UnresolvedParent(declaration.id, declaration.of);
-		return { provides: { [provideKey(declaration.id, "url")]: `${endpoint}/${bucket}` } };
+		return { provides: { [key]: `${endpoint}/${bucket}` } };
+	},
+	/**
+	* Mail: the stage's own SMTP server, or — allowed — Mailpit on the box.
+	*
+	* Every provider speaks SMTP, so the provider is whatever the stage's
+	* `<ID>_URL` names, with the address it sends from beside it. Only with
+	* `--allow-dev-services mailpit`, and only where the stage set no URL,
+	* does this run Mailpit — which catches every message and delivers none.
+	*/
+	email: async (declaration, context) => {
+		if (declaration.kind !== "email") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		const from = provideKey(declaration.id, "from");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: {
+			[key]: given,
+			[from]: supplied(declaration.id, from, context)
+		} };
+		if (!context.devServices?.includes("mailpit")) throw notConfigured(declaration.id, "email", context);
+		const service = serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id);
+		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, mailpitCompose(service));
+		await context.api.deployCompose(compose.composeId);
+		return { provides: {
+			[key]: `smtp://${service}:1025`,
+			[from]: context.supplied?.[from] ?? `noreply@${context.domain ?? "localhost"}`
+		} };
 	},
 	/**
 	* A topic, and below it a queue — the same broker either way.
@@ -985,6 +854,56 @@ function minioCompose(options) {
 		""
 	].join("\n");
 }
+/**
+* A one-service compose file for Mailpit, on `dokploy-network` so the apps
+* reach it by its service name. It accepts mail from anything on the network
+* and delivers none of it.
+*/
+function mailpitCompose(service) {
+	return [
+		"services:",
+		`  ${service}:`,
+		"    image: axllent/mailpit:latest",
+		"    environment:",
+		"      MP_SMTP_AUTH_ACCEPT_ANY: '1'",
+		"      MP_SMTP_AUTH_ALLOW_INSECURE: '1'",
+		"    networks:",
+		"      - dokploy-network",
+		"networks:",
+		"  dokploy-network:",
+		"    external: true",
+		""
+	].join("\n");
+}
+/**
+* The S3 client's shared keys the stage set, for a bucket that is its own —
+* none when it set none, since a bucket's URL may carry its own key.
+*/
+function storageKeys(values) {
+	const keys = {};
+	for (const key of [...STORAGE_KEY_PAIR, "AWS_REGION"]) {
+		const value = values?.[key];
+		if (value !== void 0) keys[key] = value;
+	}
+	return keys;
+}
+/**
+* The error for a bucket or mail the stage configured nothing for — what
+* `validate` already refused, should a provisioner be reached without it.
+*/
+function notConfigured(id, kind, context) {
+	const { missing } = externalServices({
+		stage: context.stage,
+		declarations: [{
+			id,
+			kind
+		}],
+		supplied: context.supplied ?? {},
+		allow: [],
+		...context.domain ? { domain: context.domain } : {}
+	});
+	return new ExternalServicesNotConfigured(context.stage, missing);
+}
 /** Whether anything reads through a reader on this construct. */
 function readsFrom(manifest, id) {
 	return Object.values(manifest).some((declaration) => declaration.kind === "database-reader" && declaration.of === id);
@@ -1173,6 +1092,8 @@ async function provisionDeclared(options) {
 		cache: cacheBackendFor(providerOf(workspace)),
 		events: eventsBackendFor(providerOf(workspace)),
 		storage: storageBackendFor(providerOf(workspace)),
+		...options.devServices ? { devServices: options.devServices } : {},
+		...workspace.deploy?.domains?.[options.stage] ? { domain: workspace.deploy.domains[options.stage] } : {},
 		addresses: surfaceAddresses(manifest, options.appUrls),
 		seed: options.seed,
 		...options.supplied ? { supplied: options.supplied } : {},
@@ -1273,7 +1194,7 @@ async function createDnsProvider(options) {
 	if (isDnsProvider(config.provider)) return config.provider;
 	const provider = config.provider;
 	if (provider === "hostinger") {
-		const { HostingerProvider } = await import("./HostingerProvider-CY_VpVud.mjs");
+		const { HostingerProvider } = await import("./HostingerProvider-D85ayzTi.mjs");
 		return new HostingerProvider();
 	}
 	if (provider === "route53") {
@@ -2164,8 +2085,18 @@ async function validateDokploy(phase) {
 		secrets: phase.secrets,
 		ctx
 	};
+	const stored = await phase.secrets.read();
+	const services = assertExternalServices({
+		stage,
+		declarations: manifestServiceDeclarations(phase.manifest),
+		supplied: stored?.custom ?? {},
+		allow: phase.allowDevServices,
+		...workspace.deploy?.domains?.[stage] ? { domain: workspace.deploy.domains[stage] } : {}
+	});
+	reportDevServices(phase, devServicesUsed(services));
 	return {
 		...run,
+		allowDevServices: phase.allowDevServices,
 		preflight: await preflight(run),
 		verify: verifySettings(workspace.deploy.dokploy?.verify),
 		atomic: phase.atomic,
@@ -2345,7 +2276,8 @@ async function provision(run) {
 			appUrls,
 			supplied: stageSecrets.custom,
 			seed: stageSecrets.seed,
-			manifest
+			manifest,
+			devServices: run.allowDevServices
 		});
 		declaredEnv = declared.env;
 		declaredClusters = declared.clusters;
@@ -3163,4 +3095,4 @@ const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
 //#endregion
 export { RegistryNotConfigured as _, dokployResult as a, releaseDokploy as c, validateDokploy as d, verifyDokploy as f, RegistryAmbiguous as g, HealthCheckTimedOut as h, dokployApi as i, restoreImage as l, DeployMigrationsFailed as m, FrontendDeployFailed as n, planDokploy as o, verifySettings as p, MissingEnvVars as r, provisionDokploy as s, BackendDeployFailed as t, rollbackDokploy as u, RegistryNotFound as v, ProjectNotOwned as y };
 
-//# sourceMappingURL=engine-CunvOG3s.mjs.map
+//# sourceMappingURL=engine-llWnMZH5.mjs.map