@geekmidas/cli 10.0.0-alpha.74 → 10.0.0-alpha.75

package/dist/{engine-B1b4I34Z.mjs → engine-CmozkHxq.mjs}

@@ -1,20 +1,208 @@
+import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
 import { i as LocalSandbox, t as MissingCredential } from "./credentials-pAtB70k3.mjs";
 import { a as discriminatedUnion, c as looseObject, f as string, n as array, s as literal, u as object } from "./schemas-D-xeKJDD.mjs";
 import { c as runWorker, d as output, r as discover } from "./discover-BPelzeGW.mjs";
 import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { g as stripPublicPrefix, h as getPublicEnvPrefix, s as getAppBuildOrder } from "./workspace-C7NqCsQF.mjs";
-import { $ as constructGlobs, $t as applicationName, At as eventsBackendFor, E as resolveHost, Et as WORKER_PORT, F as devServicesUsed, H as workerUnits, I as externalServices, L as manifestServiceDeclarations, M as STORAGE_KEY_PAIR, Mt as storageBackendFor, O as otelEnv, P as assertExternalServices, S as workerDockerfileOf, T as isMainFrontendApp, U as encryptSecrets, _ as deployDocker, _t as workerEnvKeys, a as recordRelease, an as ownershipMarker, c as setBackupState, d as setGeneratedSecret, f as setPostgresBackupId, i as isDnsVerified, in as markerOf, j as ExternalServicesNotConfigured, jt as providerOf, kt as cacheBackendFor, l as setDnsRecord, m as withGeneratedSecrets, n as getBackupState, nn as imageRef, o as recordRollback, on as projectName, p as DeployJournal, r as getGeneratedSecret, rn as isOwnedBy, s as setApplicationId, sn as initStageSecrets, st as applyPostgres, t as createEmptyState, tn as imageName, u as setDnsVerification, un as toEmbeddableSecrets, xt as resourceName, z as reportDevServices } from "./state-DpkxSwzI.mjs";
-import { f as StateStoreBusy, m as StateVersionConflict, o as DokployApi, s as DokployApiError, t as sniffAllApps, v as eventError } from "./sniffer-BFmdZpZ2.mjs";
+import { $t as imageRef, A as ExternalServicesNotConfigured, Ct as WORKER_PORT, D as otelEnv, Dt as eventsBackendFor, Et as cacheBackendFor, F as externalServices, I as manifestServiceDeclarations, N as assertExternalServices, Ot as providerOf, P as devServicesUsed, Qt as imageName, R as reportDevServices, S as validateImageRef, T as resolveHost, V as workerUnits, Xt as applicationName, Y as constructGlobs, a as recordRelease, c as setBackupState, d as setGeneratedSecret, en as isOwnedBy, f as setPostgresBackupId, ft as dockerfileOf, g as DockerPushFailed, h as DockerBuildFailed, i as isDnsVerified, in as initStageSecrets, j as STORAGE_KEY_PAIR, kt as storageBackendFor, l as setDnsRecord, m as withGeneratedSecrets, mt as workerEnvKeys, n as getBackupState, nn as ownershipMarker, o as recordRollback, p as DeployJournal, r as getGeneratedSecret, rn as projectName, rt as applyPostgres, s as setApplicationId, sn as toEmbeddableSecrets, t as createEmptyState, tn as markerOf, u as setDnsVerification, v as dockerCommand, vt as resourceName, w as isMainFrontendApp, x as workerDockerfileOf } from "./state-BrWIOce_.mjs";
+import { f as StateStoreBusy, m as StateVersionConflict, o as DokployApi, s as DokployApiError, t as sniffAllApps, v as eventError, x as keyFingerprint, y as encryptSecrets } from "./sniffer-BmCvVyhq.mjs";
 import { o as migrationFiles } from "./provider-D7rQzzzf.mjs";
 import { n as assertStageCredentials } from "./credentialSchemas-BJqRJNK4.mjs";
-import { join } from "node:path";
+import { join, relative } from "node:path";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { cacheTable, cloudName, cookieDomain, dependentsOf, externalApiUrl, migrationTargets, mobileOrigins, provideKey, provisionOrder, schemeBase } from "@geekmidas/manifest";
 import { createHash, randomBytes } from "node:crypto";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { Client } from "pg";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
 import { lookup } from "node:dns/promises";
+//#region src/deploy/docker.ts
+const logger$3 = output;
+/**
+* The id the Dockerfile templates mount the encrypted credentials under:
+* `RUN --mount=type=secret,id=gkm_credentials`.
+*/
+const CREDENTIALS_SECRET_ID = "gkm_credentials";
+/**
+* Get the full image reference
+*/
+function getImageRef(registry, imageName, tag) {
+	if (registry) return `${registry}/${imageName}:${tag}`;
+	return `${imageName}:${tag}`;
+}
+/**
+* The `docker build` argv for an image.
+*
+* One element per value, so nothing in a ref or a build arg is read by a
+* shell, and `--opt=value` rather than `--opt value`, so a value that starts
+* with `-` cannot be taken for one of docker's own flags.
+*
+* @internal Exported for testing
+*/
+function dockerBuildArgs(options) {
+	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
+	return [
+		"build",
+		"--platform=linux/amd64",
+		`--file=${dockerfilePath}`,
+		`--tag=${imageRef}`,
+		...buildArgs.map((arg) => `--build-arg=${arg}`),
+		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
+		"."
+	];
+}
+/**
+* The build arg that names which credentials an image embeds: a hash of the
+* ciphertext, which is not a secret. A BuildKit secret is no part of the
+* build cache's key, so without it a rebuild with credentials encrypted under
+* a new key would reuse the layer that embedded the old ones.
+*/
+function credentialsBuildArg(credentials) {
+	return `GKM_CIPHERTEXT_HASH=${createHash("sha256").update(`${credentials.encrypted}\n${credentials.iv}`).digest("hex").slice(0, 16)}`;
+}
+/** The secret file's content: ciphertext, then IV, one per line. */
+function credentialsFileContent(credentials) {
+	return `${credentials.encrypted}\n${credentials.iv}\n`;
+}
+/**
+* Write the encrypted credentials where `docker build --secret` reads them.
+*
+* Two lines — ciphertext, then IV — so a template can split them with `sed`
+* in any base image. Owner-only, in a directory of its own, and the returned
+* cleanup removes both whatever the build did.
+*
+* @internal Exported for testing
+*/
+async function writeCredentialsFile(credentials) {
+	const dir = await mkdtemp(join(tmpdir(), "gkm-credentials-"));
+	const path = join(dir, CREDENTIALS_SECRET_ID);
+	await writeFile(path, credentialsFileContent(credentials), { mode: 384 });
+	await chmod(path, 384);
+	return {
+		path,
+		cleanup: () => rm(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+/**
+* Build Docker image
+* @param imageRef - Full image reference (registry/name:tag)
+* @param buildArgs - Build arguments to pass to docker build
+* @param credentials - Encrypted credentials, passed as a build secret
+*/
+async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
+	logger$3.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$3.log("   Generating Dockerfile...");
+	const { buildRoot } = await dockerCommand({ cwd });
+	const dockerfilePath = relative(buildRoot, dockerfile);
+	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
+	try {
+		await run("docker", dockerBuildArgs({
+			dockerfilePath,
+			imageRef,
+			buildArgs: [...buildArgs ?? [], ...credentials ? [credentialsBuildArg(credentials)] : []],
+			credentialsFile: secret?.path
+		}), {
+			cwd: buildRoot,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			},
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$3.log(`✅ Image built: ${imageRef}`);
+	} catch (error) {
+		throw new DockerBuildFailed(imageRef, error);
+	} finally {
+		await secret?.cleanup();
+	}
+}
+/**
+* Push Docker image to registry
+*/
+async function pushImage(imageRef, { cwd, signal, stdio }) {
+	logger$3.log(`\n☁️  Pushing image: ${imageRef}`);
+	try {
+		await run("docker", ["push", imageRef], {
+			cwd,
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$3.log(`✅ Image pushed: ${imageRef}`);
+	} catch (error) {
+		throw new DockerPushFailed(imageRef, error);
+	}
+}
+/**
+* The digest the registry gave a pushed image, `sha256:…`.
+*
+* A tag can be pushed over — by the next deploy, or by anything else that
+* shares the repository — and the digest is what says which image a stage
+* actually ran. `RepoDigests` has one entry per repository the image was
+* pushed to, so the one for this ref's repository is picked by name.
+*
+* @internal Exported for testing
+*/
+async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
+	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	const output = await runOutput("docker", [
+		"image",
+		"inspect",
+		"--format={{json .RepoDigests}}",
+		imageRef
+	], {
+		cwd,
+		...signal ? { signal } : {}
+	});
+	let digests;
+	try {
+		digests = JSON.parse(output.trim() || "[]");
+	} catch {
+		return;
+	}
+	if (!Array.isArray(digests)) return void 0;
+	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+}
+/**
+* Deploy using Docker (build and optionally push image)
+*/
+async function deployDocker(options) {
+	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
+	const imageName = config.imageName;
+	const imageRef = validateImageRef(getImageRef(config.registry, imageName, tag));
+	const cwd = options.cwd ?? process.cwd();
+	const docker = {
+		cwd,
+		dockerfile: join(cwd, options.dockerfile ?? dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
+		...options.signal ? { signal: options.signal } : {},
+		...options.stdio ? { stdio: options.stdio } : {}
+	};
+	await buildImage(imageRef, buildArgs, credentials, docker);
+	let digest;
+	if (!skipPush) {
+		if (!config.registry) logger$3.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		else {
+			await pushImage(imageRef, docker);
+			digest = await pushedDigest(imageRef, docker);
+		}
+	}
+	logger$3.log("\n✅ Docker deployment ready!");
+	logger$3.log(`\n📋 Deployment details:`);
+	logger$3.log(`   Image: ${imageRef}`);
+	logger$3.log(`   Stage: ${stage}`);
+	if (masterKey) logger$3.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${keyFingerprint(masterKey)}.`);
+	return {
+		imageRef,
+		...digest ? { digest } : {},
+		masterKey
+	};
+}
+//#endregion
 //#region src/deploy/ownership.ts
 /**
 * Which Dokploy project a deploy is allowed to deploy into.
@@ -3204,4 +3392,4 @@ const MOBILE_SKIP_REASON = "deploys via its framework toolchain";
 //#endregion
 export { RegistryNotConfigured as _, dokployResult as a, releaseDokploy as c, validateDokploy as d, verifyDokploy as f, RegistryAmbiguous as g, HealthCheckTimedOut as h, dokployApi as i, restoreImage as l, DeployMigrationsFailed as m, FrontendDeployFailed as n, planDokploy as o, verifySettings as p, MissingEnvVars as r, provisionDokploy as s, BackendDeployFailed as t, rollbackDokploy as u, RegistryNotFound as v, ProjectNotOwned as y };
 
-//# sourceMappingURL=engine-B1b4I34Z.mjs.map
+//# sourceMappingURL=engine-CmozkHxq.mjs.map