@geekmidas/cli 10.0.0-alpha.67 → 10.0.0-alpha.69

package/dist/{engine-Gs0abjuj.mjs → engine-62Kl70Pj.mjs}

@@ -1,12 +1,13 @@
 import { i as LocalSandbox, t as MissingCredential } from "./credentials-pAtB70k3.mjs";
-import { a as discriminatedUnion, d as string, l as object, n as array, o as literal, s as looseObject } from "./schemas-Cfhtpdo0.mjs";
-import { c as runWorker, d as output, r as discover } from "./discover-BFoJWKGD.mjs";
+import { a as discriminatedUnion, c as looseObject, f as string, n as array, s as literal, u as object } from "./schemas-D-xeKJDD.mjs";
+import { c as runWorker, d as output, r as discover } from "./discover-Buwf1z4P.mjs";
 import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { g as stripPublicPrefix, h as getPublicEnvPrefix, s as getAppBuildOrder } from "./workspace-Be6uBhlF.mjs";
-import { $ as cacheBackendFor, At as projectName, C as resolveHost, Ct as applicationName, Dt as isOwnedBy, Et as imageRef, F as applyPostgres, K as resourceName, Ot as markerOf, Pt as toEmbeddableSecrets, S as isMainFrontendApp, Tt as imageName, _ as deployDocker, a as recordRelease, c as setBackupState, d as setGeneratedSecret, et as eventsBackendFor, f as setPostgresBackupId, i as isDnsVerified, jt as initStageSecrets, k as constructGlobs, kt as ownershipMarker, l as setDnsRecord, m as withGeneratedSecrets, n as getBackupState, nt as storageBackendFor, o as recordRollback, p as DeployJournal, r as getGeneratedSecret, s as setApplicationId, t as createEmptyState, tt as providerOf, u as setDnsVerification, w as encryptSecrets } from "./state-DkUStoqJ.mjs";
-import { f as StateStoreBusy, m as StateVersionConflict, o as DokployApi, s as DokployApiError, t as sniffAllApps, v as eventError } from "./sniffer-BdFeLSmA.mjs";
+import { g as stripPublicPrefix, h as getPublicEnvPrefix, s as getAppBuildOrder } from "./workspace-B2UK_rVP.mjs";
+import { A as assertExternalServices, C as isMainFrontendApp, D as ExternalServicesNotConfigured, F as reportDevServices, Gt as isOwnedBy, Jt as projectName, Kt as markerOf, M as externalServices, N as manifestServiceDeclarations, O as STORAGE_KEY_PAIR, Qt as toEmbeddableSecrets, R as encryptSecrets, U as constructGlobs, Ut as imageName, Vt as applicationName, Wt as imageRef, Yt as initStageSecrets, Z as applyPostgres, _ as deployDocker, _t as cacheBackendFor, a as recordRelease, bt as storageBackendFor, c as setBackupState, d as setGeneratedSecret, f as setPostgresBackupId, i as isDnsVerified, j as devServicesUsed, l as setDnsRecord, m as withGeneratedSecrets, n as getBackupState, o as recordRollback, p as DeployJournal, qt as ownershipMarker, r as getGeneratedSecret, s as setApplicationId, t as createEmptyState, u as setDnsVerification, ut as resourceName, vt as eventsBackendFor, w as resolveHost, yt as providerOf } from "./state-DClnPZt5.mjs";
+import { f as StateStoreBusy, m as StateVersionConflict, o as DokployApi, s as DokployApiError, t as sniffAllApps, v as eventError } from "./sniffer-DMqi2b1q.mjs";
 import { o as migrationFiles } from "./provider-D7rQzzzf.mjs";
+import { n as assertStageCredentials } from "./credentialSchemas-BmYxnEz_.mjs";
 import { join } from "node:path";
 import { cacheTable, cloudName, cookieDomain, dependentsOf, externalApiUrl, migrationTargets, mobileOrigins, provideKey, provisionOrder, schemeBase } from "@geekmidas/manifest";
 import { createHash, randomBytes } from "node:crypto";
@@ -507,34 +508,47 @@ const PROVISIONERS = {
 		return { provides: { [provideKey(declaration.id, "url")]: url.toString() } };
 	},
 	/**
-	* A bucket, as a MinIO stack on the box.
+	* A bucket: the stage's own, or — allowed — a MinIO stack on the box.
+	*
+	* A deployed stage's bucket is an external one — S3, R2, any S3-compatible
+	* store — whose URL and key pair the stage's secrets hold. Only with
+	* `--allow-dev-services minio` does this target run MinIO for one, and
+	* then only for a bucket whose URL the stage did not set.
 	*
 	* Dokploy has first-class primitives for Postgres and Redis and none for
-	* object storage, so this is the one kind whose infrastructure this target
-	* *writes* rather than configures — a compose file with one service in it.
+	* object storage, so MinIO is the one kind whose infrastructure this
+	* target *writes* rather than configures — a compose file with one
+	* service in it.
 	*
 	* The service is named `cloudName(...)` like everything else, which is not
 	* cosmetic here: containers on `dokploy-network` resolve each other by
 	* service name, so the name is the address. Calling it `minio` would work
 	* for exactly one project on the box and then collide.
 	*
-	* `s3://` carries no credentials, deliberately — deployed on AWS the SDK
-	* reads them from an execution role, so a URL that embedded a key would be
-	* one more thing to rotate and leak. There is no role here, so the same
-	* chain reads `AWS_ACCESS_KEY_ID` beside the URL, exactly as it does
-	* locally.
+	* A stage's own bucket URL may carry a key scoped to that bucket
+	* (`s3://KEY:SECRET@bucket`), which the client signs with; the shared
+	* `AWS_ACCESS_KEY_ID` pair is passed beside it when the stage set one, for
+	* a bucket whose URL has none. The MinIO this provisions uses that pair —
+	* the stage's, or one derived for it.
 	*/
 	objects: async (declaration, context) => {
 		if (declaration.kind !== "objects") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: {
+			[key]: given,
+			...storageKeys(context.supplied)
+		} };
 		const backend = context.storage ?? "minio";
 		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
+		if (!context.devServices?.includes("minio")) throw notConfigured(declaration.id, "objects", context);
 		const service = serviceName({
 			stage: context.stage,
 			app: context.scope ?? context.project
 		}, declaration.id);
 		const bucket = resourceName(declaration.id, declaration.kind, context.stage);
-		const user = `${bucket}-root`;
-		const password = derivedPassword(context, `objects:${declaration.id}`);
+		const user = context.supplied?.AWS_ACCESS_KEY_ID ?? `${bucket}-root`;
+		const password = context.supplied?.AWS_SECRET_ACCESS_KEY ?? derivedPassword(context, `objects:${declaration.id}`);
 		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
 			service,
 			bucket,
@@ -543,33 +557,67 @@ const PROVISIONERS = {
 		}));
 		await context.api.deployCompose(compose.composeId);
 		return { provides: {
-			[provideKey(declaration.id, "url")]: s3Url(service, bucket),
+			[key]: s3Url(service, bucket),
 			AWS_ACCESS_KEY_ID: user,
 			AWS_SECRET_ACCESS_KEY: password,
-			AWS_REGION: MINIO_REGION
+			AWS_REGION: context.supplied?.AWS_REGION ?? MINIO_REGION
 		} };
 	},
 	/**
 	* The address a bucket's objects are served on.
 	*
-	* Nothing is provisioned: Dokploy runs Traefik, so a second reverse proxy
-	* behind the first would terminate TLS twice — which is why the local
-	* target's Caddy has no equivalent here. What this resolves is the address,
-	* and the `open` prefixes are applied to the bucket rather than to an edge,
-	* so a policy is what makes them public wherever the bucket lives.
+	* The stage's own — a CDN, the bucket's domain — when its secrets hold
+	* one, which a bucket that is not MinIO's needs.
 	*
-	* Until a Traefik rule exists it answers on MinIO directly, path-style,
-	* which is honest about the shape it has today: the bucket is in the path
-	* rather than fronted by a host of its own.
+	* Over MinIO nothing is provisioned: Dokploy runs Traefik, so a second
+	* reverse proxy behind the first would terminate TLS twice — which is why
+	* the local target's Caddy has no equivalent here. What this resolves is
+	* the address, and the `open` prefixes are applied to the bucket rather
+	* than to an edge, so a policy is what makes them public wherever the
+	* bucket lives. Until a Traefik rule exists it answers on MinIO directly,
+	* path-style, which is honest about the shape it has today: the bucket is
+	* in the path rather than fronted by a host of its own.
 	*/
 	"file-server": async (declaration, context) => {
 		if (declaration.kind !== "file-server") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: { [key]: given } };
 		const parentUrl = context.provisioned[declaration.of]?.provides[provideKey(declaration.of, "url")];
 		if (!parentUrl) throw new UnresolvedParent(declaration.id, declaration.of);
 		const endpoint = new URL(parentUrl).searchParams.get("endpoint");
 		const bucket = new URL(parentUrl).hostname;
 		if (!endpoint) throw new UnresolvedParent(declaration.id, declaration.of);
-		return { provides: { [provideKey(declaration.id, "url")]: `${endpoint}/${bucket}` } };
+		return { provides: { [key]: `${endpoint}/${bucket}` } };
+	},
+	/**
+	* Mail: the stage's own SMTP server, or — allowed — Mailpit on the box.
+	*
+	* Every provider speaks SMTP, so the provider is whatever the stage's
+	* `<ID>_URL` names, with the address it sends from beside it. Only with
+	* `--allow-dev-services mailpit`, and only where the stage set no URL,
+	* does this run Mailpit — which catches every message and delivers none.
+	*/
+	email: async (declaration, context) => {
+		if (declaration.kind !== "email") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		const from = provideKey(declaration.id, "from");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: {
+			[key]: given,
+			[from]: supplied(declaration.id, from, context)
+		} };
+		if (!context.devServices?.includes("mailpit")) throw notConfigured(declaration.id, "email", context);
+		const service = serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id);
+		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, mailpitCompose(service));
+		await context.api.deployCompose(compose.composeId);
+		return { provides: {
+			[key]: `smtp://${service}:1025`,
+			[from]: context.supplied?.[from] ?? `noreply@${context.domain ?? "localhost"}`
+		} };
 	},
 	/**
 	* A topic, and below it a queue — the same broker either way.
@@ -807,6 +855,56 @@ function minioCompose(options) {
 		""
 	].join("\n");
 }
+/**
+* A one-service compose file for Mailpit, on `dokploy-network` so the apps
+* reach it by its service name. It accepts mail from anything on the network
+* and delivers none of it.
+*/
+function mailpitCompose(service) {
+	return [
+		"services:",
+		`  ${service}:`,
+		"    image: axllent/mailpit:latest",
+		"    environment:",
+		"      MP_SMTP_AUTH_ACCEPT_ANY: '1'",
+		"      MP_SMTP_AUTH_ALLOW_INSECURE: '1'",
+		"    networks:",
+		"      - dokploy-network",
+		"networks:",
+		"  dokploy-network:",
+		"    external: true",
+		""
+	].join("\n");
+}
+/**
+* The S3 client's shared keys the stage set, for a bucket that is its own —
+* none when it set none, since a bucket's URL may carry its own key.
+*/
+function storageKeys(values) {
+	const keys = {};
+	for (const key of [...STORAGE_KEY_PAIR, "AWS_REGION"]) {
+		const value = values?.[key];
+		if (value !== void 0) keys[key] = value;
+	}
+	return keys;
+}
+/**
+* The error for a bucket or mail the stage configured nothing for — what
+* `validate` already refused, should a provisioner be reached without it.
+*/
+function notConfigured(id, kind, context) {
+	const { missing } = externalServices({
+		stage: context.stage,
+		declarations: [{
+			id,
+			kind
+		}],
+		supplied: context.supplied ?? {},
+		allow: [],
+		...context.domain ? { domain: context.domain } : {}
+	});
+	return new ExternalServicesNotConfigured(context.stage, missing);
+}
 /** Whether anything reads through a reader on this construct. */
 function readsFrom(manifest, id) {
 	return Object.values(manifest).some((declaration) => declaration.kind === "database-reader" && declaration.of === id);
@@ -995,6 +1093,8 @@ async function provisionDeclared(options) {
 		cache: cacheBackendFor(providerOf(workspace)),
 		events: eventsBackendFor(providerOf(workspace)),
 		storage: storageBackendFor(providerOf(workspace)),
+		...options.devServices ? { devServices: options.devServices } : {},
+		...workspace.deploy?.domains?.[options.stage] ? { domain: workspace.deploy.domains[options.stage] } : {},
 		addresses: surfaceAddresses(manifest, options.appUrls),
 		seed: options.seed,
 		...options.supplied ? { supplied: options.supplied } : {},
@@ -1986,8 +2086,25 @@ async function validateDokploy(phase) {
 		secrets: phase.secrets,
 		ctx
 	};
+	const stored = await phase.secrets.read();
+	const services = assertExternalServices({
+		stage,
+		declarations: manifestServiceDeclarations(phase.manifest),
+		supplied: stored?.custom ?? {},
+		allow: phase.allowDevServices,
+		...workspace.deploy?.domains?.[stage] ? { domain: workspace.deploy.domains[stage] } : {}
+	});
+	reportDevServices(phase, devServicesUsed(services));
+	await assertStageCredentials({
+		root: workspace.root,
+		patterns: constructGlobs(workspace),
+		manifest: phase.manifest,
+		stage,
+		supplied: stored?.custom ?? {}
+	});
 	return {
 		...run,
+		allowDevServices: phase.allowDevServices,
 		preflight: await preflight(run),
 		verify: verifySettings(workspace.deploy.dokploy?.verify),
 		atomic: phase.atomic,
@@ -2167,7 +2284,8 @@ async function provision(run) {
 			appUrls,
 			supplied: stageSecrets.custom,
 			seed: stageSecrets.seed,
-			manifest
+			manifest,
+			devServices: run.allowDevServices
 		});
 		declaredEnv = declared.env;
 		declaredClusters = declared.clusters;
@@ -2985,4 +3103,4 @@ const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
 //#endregion
 export { RegistryNotConfigured as _, dokployResult as a, releaseDokploy as c, validateDokploy as d, verifyDokploy as f, RegistryAmbiguous as g, HealthCheckTimedOut as h, dokployApi as i, restoreImage as l, DeployMigrationsFailed as m, FrontendDeployFailed as n, planDokploy as o, verifySettings as p, MissingEnvVars as r, provisionDokploy as s, BackendDeployFailed as t, rollbackDokploy as u, RegistryNotFound as v, ProjectNotOwned as y };
 
-//# sourceMappingURL=engine-Gs0abjuj.mjs.map
+//# sourceMappingURL=engine-62Kl70Pj.mjs.map