@geekmidas/cli 10.0.0-alpha.74 → 10.0.0-alpha.76

package/dist/{engine-Bh76sAHy.cjs → engine-C0N2d1i5.cjs}

@@ -1,20 +1,208 @@
+const require_run = require("./run-fVZ-rLnc.cjs");
 const require_credentials = require("./credentials-BVs7mrtw.cjs");
 const require_schemas = require("./schemas-BObwxB_t.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_sandbox = require("./sandbox-CL--ZDui.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-vdrcRI-m.cjs");
-const require_state = require("./state-DCwRWyh-.cjs");
-const require_sniffer = require("./sniffer-C-T7dSMN.cjs");
+const require_workspace = require("./workspace-DOm81oUo.cjs");
+const require_state = require("./state-C2qi0iQw.cjs");
+const require_sniffer = require("./sniffer-Y6GQOCXB.cjs");
 const require_provider = require("./provider-B3Sv_a74.cjs");
 const require_credentialSchemas = require("./credentialSchemas-DCR4Wd1W.cjs");
 let node_path = require("node:path");
+let node_fs_promises = require("node:fs/promises");
+let node_os = require("node:os");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let node_crypto = require("node:crypto");
 let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let pg = require("pg");
 let _geekmidas_cache_postgres = require("@geekmidas/cache/postgres");
 let node_dns_promises = require("node:dns/promises");
+//#region src/deploy/docker.ts
+const logger$3 = require_discover.output;
+/**
+* The id the Dockerfile templates mount the encrypted credentials under:
+* `RUN --mount=type=secret,id=gkm_credentials`.
+*/
+const CREDENTIALS_SECRET_ID = "gkm_credentials";
+/**
+* Get the full image reference
+*/
+function getImageRef(registry, imageName, tag) {
+	if (registry) return `${registry}/${imageName}:${tag}`;
+	return `${imageName}:${tag}`;
+}
+/**
+* The `docker build` argv for an image.
+*
+* One element per value, so nothing in a ref or a build arg is read by a
+* shell, and `--opt=value` rather than `--opt value`, so a value that starts
+* with `-` cannot be taken for one of docker's own flags.
+*
+* @internal Exported for testing
+*/
+function dockerBuildArgs(options) {
+	const { dockerfilePath, imageRef, buildArgs = [], credentialsFile } = options;
+	return [
+		"build",
+		"--platform=linux/amd64",
+		`--file=${dockerfilePath}`,
+		`--tag=${imageRef}`,
+		...buildArgs.map((arg) => `--build-arg=${arg}`),
+		...credentialsFile ? [`--secret=id=${CREDENTIALS_SECRET_ID},src=${credentialsFile}`] : [],
+		"."
+	];
+}
+/**
+* The build arg that names which credentials an image embeds: a hash of the
+* ciphertext, which is not a secret. A BuildKit secret is no part of the
+* build cache's key, so without it a rebuild with credentials encrypted under
+* a new key would reuse the layer that embedded the old ones.
+*/
+function credentialsBuildArg(credentials) {
+	return `GKM_CIPHERTEXT_HASH=${(0, node_crypto.createHash)("sha256").update(`${credentials.encrypted}\n${credentials.iv}`).digest("hex").slice(0, 16)}`;
+}
+/** The secret file's content: ciphertext, then IV, one per line. */
+function credentialsFileContent(credentials) {
+	return `${credentials.encrypted}\n${credentials.iv}\n`;
+}
+/**
+* Write the encrypted credentials where `docker build --secret` reads them.
+*
+* Two lines — ciphertext, then IV — so a template can split them with `sed`
+* in any base image. Owner-only, in a directory of its own, and the returned
+* cleanup removes both whatever the build did.
+*
+* @internal Exported for testing
+*/
+async function writeCredentialsFile(credentials) {
+	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "gkm-credentials-"));
+	const path = (0, node_path.join)(dir, CREDENTIALS_SECRET_ID);
+	await (0, node_fs_promises.writeFile)(path, credentialsFileContent(credentials), { mode: 384 });
+	await (0, node_fs_promises.chmod)(path, 384);
+	return {
+		path,
+		cleanup: () => (0, node_fs_promises.rm)(dir, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+/**
+* Build Docker image
+* @param imageRef - Full image reference (registry/name:tag)
+* @param buildArgs - Build arguments to pass to docker build
+* @param credentials - Encrypted credentials, passed as a build secret
+*/
+async function buildImage(imageRef, buildArgs, credentials, { cwd, dockerfile, signal, stdio }) {
+	logger$3.log(`\n🔨 Building Docker image: ${imageRef}`);
+	logger$3.log("   Generating Dockerfile...");
+	const { buildRoot } = await require_state.dockerCommand({ cwd });
+	const dockerfilePath = (0, node_path.relative)(buildRoot, dockerfile);
+	const secret = credentials ? await writeCredentialsFile(credentials) : void 0;
+	try {
+		await require_run.run("docker", dockerBuildArgs({
+			dockerfilePath,
+			imageRef,
+			buildArgs: [...buildArgs ?? [], ...credentials ? [credentialsBuildArg(credentials)] : []],
+			credentialsFile: secret?.path
+		}), {
+			cwd: buildRoot,
+			env: {
+				...process.env,
+				DOCKER_BUILDKIT: "1"
+			},
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$3.log(`✅ Image built: ${imageRef}`);
+	} catch (error) {
+		throw new require_state.DockerBuildFailed(imageRef, error);
+	} finally {
+		await secret?.cleanup();
+	}
+}
+/**
+* Push Docker image to registry
+*/
+async function pushImage(imageRef, { cwd, signal, stdio }) {
+	logger$3.log(`\n☁️  Pushing image: ${imageRef}`);
+	try {
+		await require_run.run("docker", ["push", imageRef], {
+			cwd,
+			...signal ? { signal } : {},
+			...stdio ? { stdio } : {}
+		});
+		logger$3.log(`✅ Image pushed: ${imageRef}`);
+	} catch (error) {
+		throw new require_state.DockerPushFailed(imageRef, error);
+	}
+}
+/**
+* The digest the registry gave a pushed image, `sha256:…`.
+*
+* A tag can be pushed over — by the next deploy, or by anything else that
+* shares the repository — and the digest is what says which image a stage
+* actually ran. `RepoDigests` has one entry per repository the image was
+* pushed to, so the one for this ref's repository is picked by name.
+*
+* @internal Exported for testing
+*/
+async function pushedDigest(imageRef, { cwd, signal } = { cwd: process.cwd() }) {
+	const repository = imageRef.split("@")[0].replace(/:[\w][\w.-]*$/, "");
+	const output = await require_run.runOutput("docker", [
+		"image",
+		"inspect",
+		"--format={{json .RepoDigests}}",
+		imageRef
+	], {
+		cwd,
+		...signal ? { signal } : {}
+	});
+	let digests;
+	try {
+		digests = JSON.parse(output.trim() || "[]");
+	} catch {
+		return;
+	}
+	if (!Array.isArray(digests)) return void 0;
+	return digests.find((entry) => typeof entry === "string" && entry.startsWith(`${repository}@`))?.slice(repository.length + 1);
+}
+/**
+* Deploy using Docker (build and optionally push image)
+*/
+async function deployDocker(options) {
+	const { stage, tag, skipPush, masterKey, config, buildArgs, credentials } = options;
+	const imageName = config.imageName;
+	const imageRef = require_state.validateImageRef(getImageRef(config.registry, imageName, tag));
+	const cwd = options.cwd ?? process.cwd();
+	const docker = {
+		cwd,
+		dockerfile: (0, node_path.join)(cwd, options.dockerfile ?? require_state.dockerfileOf(config.appName ?? imageName, options.appPath ?? ".")),
+		...options.signal ? { signal: options.signal } : {},
+		...options.stdio ? { stdio: options.stdio } : {}
+	};
+	await buildImage(imageRef, buildArgs, credentials, docker);
+	let digest;
+	if (!skipPush) {
+		if (!config.registry) logger$3.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
+		else {
+			await pushImage(imageRef, docker);
+			digest = await pushedDigest(imageRef, docker);
+		}
+	}
+	logger$3.log("\n✅ Docker deployment ready!");
+	logger$3.log(`\n📋 Deployment details:`);
+	logger$3.log(`   Image: ${imageRef}`);
+	logger$3.log(`   Stage: ${stage}`);
+	if (masterKey) logger$3.log(`\n🔐 Run the container with GKM_MASTER_KEY set to the key with fingerprint ${require_sniffer.keyFingerprint(masterKey)}.`);
+	return {
+		imageRef,
+		...digest ? { digest } : {},
+		masterKey
+	};
+}
+//#endregion
 //#region src/deploy/ownership.ts
 /**
 * Which Dokploy project a deploy is allowed to deploy into.
@@ -262,7 +450,7 @@ function filterSecretsForApp(stageSecrets, sniffedEnv) {
 * @returns Encrypted payload with master key
 */
 function encryptSecretsForApp(filteredSecrets) {
-	const payload = require_state.encryptSecrets(filteredSecrets.secrets);
+	const payload = require_sniffer.encryptSecrets(filteredSecrets.secrets);
 	return {
 		appName: filteredSecrets.appName,
 		payload,
@@ -2482,7 +2670,7 @@ async function releaseDokploy(run) {
 				if (appSecrets && credentials) logger.log(`      Encrypted ${appSecrets.secretCount} secrets`);
 				const imageRef$1 = require_state.imageRef(identity, appName, registry, imageTag);
 				logger.log(`      Building Docker image: ${imageRef$1}`);
-				const image = await require_state.deployDocker({
+				const image = await deployDocker({
 					stage,
 					tag: imageTag,
 					skipPush: false,
@@ -2572,7 +2760,7 @@ async function releaseDokploy(run) {
 				} : void 0;
 				const imageRef$2 = require_state.imageRef(identity, worker.name, registry, imageTag);
 				logger.log(`      Building Docker image: ${imageRef$2}`);
-				const image = await require_state.deployDocker({
+				const image = await deployDocker({
 					stage,
 					tag: imageTag,
 					skipPush: false,
@@ -2657,7 +2845,7 @@ async function releaseDokploy(run) {
 				if (buildArgs.length > 0) logger.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
 				const imageRef$3 = require_state.imageRef(identity, appName, registry, imageTag);
 				logger.log(`      Building Docker image: ${imageRef$3}`);
-				const image = await require_state.deployDocker({
+				const image = await deployDocker({
 					stage,
 					tag: imageTag,
 					skipPush: false,
@@ -3317,4 +3505,4 @@ Object.defineProperty(exports, "verifySettings", {
 	}
 });
 
-//# sourceMappingURL=engine-Bh76sAHy.cjs.map
+//# sourceMappingURL=engine-C0N2d1i5.cjs.map