@geekmidas/cli 10.0.0-alpha.94 → 10.0.0-alpha.95

package/dist/deploy-CeJ5D0xn.mjs

@@ -1,641 +0,0 @@
-import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { r as storedCredentials, x as gkmHome } from "./credentials-DpfnUvIR.mjs";
-import { f as withOutput, r as discover } from "./discover-qjFapetL.mjs";
-import { c as withSandbox } from "./sandbox-CbVB7uOD.mjs";
-import { n as derivedApps } from "./derive-B4vDpzgP.mjs";
-import { L as resolveStageTelemetry, N as assertDeployedStage, u as getAppBuildOrder } from "./workspace-DWK1PTXP.mjs";
-import { o as builtinTarget } from "./define-6poNqm5O.mjs";
-import { findWorkspaceRoot, loadWorkspaceConfig } from "./config.mjs";
-import { En as usesTelemetry, Hn as secretsStoreFor, K as dnsCredentials, Q as stageDnsDomains, St as constructGlobs, Xn as applicationName, Zn as deployIdentity, ir as initStageSecrets, x as DevServicesNeedServerTarget } from "./seeds-CTxTZa-R.mjs";
-import { a as parseTargetOptions, o as resolveTarget } from "./resolve-Dyd1S2wn.mjs";
-import { t as LocalSandbox } from "./local-B7Zv1NoA.mjs";
-import { S as eventError, _ as assertStateOutlivesRun, y as createStateStore } from "./sniffer-DCcuzHz_.mjs";
-import { t as provisionStage } from "./providers-sTj-BG0S.mjs";
-import { resolve } from "node:path";
-//#region src/target/secrets.ts
-/**
-* A stage's secrets as a target sees them: read and written through the
-* stage's own store, and masked in everything the run prints once read.
-*/
-/**
-* Shorter values are left alone: what a progress line legitimately prints —
-* a port, a stage, an app name — would otherwise come out as `***` wherever
-* a secret happened to share it.
-*/
-const SHORTEST_MASKED = 6;
-/** The values a run must never print, and the rewrite that keeps it so. */
-var Redactor = class {
-	values = /* @__PURE__ */ new Set();
-	add(value) {
-		if (value && value.length >= SHORTEST_MASKED) this.values.add(value);
-	}
-	/** `text` with every masked value replaced by `***`, longest first. */
-	redact(text) {
-		if (this.values.size === 0) return text;
-		let out = text;
-		const longestFirst = [...this.values].sort((a, b) => b.length - a.length);
-		for (const value of longestFirst) out = out.replaceAll(value, "***");
-		return out;
-	}
-};
-/** Every value in `secrets` that is a secret rather than a label. */
-function secretValues(secrets) {
-	return [
-		secrets.seed,
-		...Object.values(secrets.custom ?? {}),
-		...Object.values(secrets.urls ?? {}),
-		...Object.values(secrets.services ?? {}).map((service) => service?.password)
-	].filter((value) => typeof value === "string");
-}
-/**
-* The stage's secrets through the store `secrets.store` names for it. Opening
-* one builds a client and makes no request, so a target that never reads them
-* costs nothing.
-*/
-async function deploySecrets(workspace, stage, redactor, options = {}) {
-	const store = await secretsStoreFor(workspace, stage, options);
-	const mask = (secrets) => {
-		for (const value of secretValues(secrets)) redactor.add(value);
-	};
-	return {
-		store: store.name,
-		async read() {
-			const secrets = await store.read(stage);
-			if (secrets) mask(secrets);
-			return secrets;
-		},
-		async write(secrets) {
-			mask(secrets);
-			await store.write(stage, secrets);
-		},
-		mask: (value) => redactor.add(value)
-	};
-}
-//#endregion
-//#region src/deploy/orchestrate.ts
-/**
-* The run around a target: what every deploy does whatever it deploys
-* through.
-*
-* It loads the workspace, resolves the target, works out the apps and the
-* identity, takes the stage's lock, and calls the target's phases in order,
-* reporting each as it starts, finishes or fails. Everything that is about
-* *where* the stage goes is the target's.
-*/
-/** `--resources-only` with `--skip-resources`: the one asks for what the other skips. */
-var ResourcesOnlyAndSkipped = class extends GkmError {
-	constructor() {
-		super("--resources-only creates the stage's resources and nothing else, and --skip-resources deploys without creating them. Run the first where the cloud credentials are (a CI runner), then the second where the stack runs.");
-		this.name = "ResourcesOnlyAndSkipped";
-	}
-};
-/** Apps were asked for by name that the workspace does not have. */
-var UnknownDeployApps = class extends GkmError {
-	apps;
-	available;
-	constructor(apps, available) {
-		super(`Unknown apps: ${apps.join(", ")}\nAvailable apps: ${available.join(", ")}`);
-		this.apps = apps;
-		this.available = available;
-		this.name = "UnknownDeployApps";
-	}
-};
-/** Every app asked for deploys through some other target. */
-var NoDeployableApps = class extends GkmError {
-	stage;
-	target;
-	constructor(stage, target) {
-		super(`No apps to deploy through "${target}": every selected app deploys somewhere else. Pick the target with --target, or set each app's deploy in gkm.config.ts.`);
-		this.stage = stage;
-		this.target = target;
-		this.name = "NoDeployableApps";
-	}
-};
-/** A build-only run through a target with no build phase. */
-var TargetBuildsNothing = class extends GkmError {
-	target;
-	constructor(target) {
-		super(`"${target}" has no build phase, so a build-only run would do nothing. Deploy it in full, or build through a target that builds images (compose).`);
-		this.target = target;
-		this.name = "TargetBuildsNothing";
-	}
-};
-/** A failed rollback, after the failure that called for it. */
-var RollbackFailed = class extends Error {
-	target;
-	failure;
-	constructor(target, failure, cause) {
-		super(`Deploying through "${target}" failed, and so did rolling it back: ${cause instanceof Error ? cause.message : String(cause)}. The stage may be part-released; deploy again, or roll it back by hand. The first failure: ${failure instanceof Error ? failure.message : String(failure)}`, { cause });
-		this.target = target;
-		this.failure = failure;
-		this.name = "RollbackFailed";
-	}
-};
-/**
-* Generate image tag from stage and timestamp
-*/
-function generateTag(stage) {
-	return `${stage}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19)}`;
-}
-/** Why an app that deploys through another target is left out. */
-function elsewhere(target, stage) {
-	const instead = builtinTarget(target)?.instead?.(stage);
-	if (instead) return `it deploys through "${target}" — ${instead}`;
-	return `it deploys through "${target}" — run \`gkm deploy --target ${target} --stage ${stage}\``;
-}
-/**
-* Deploy a workspace's stage through its target.
-*
-* The engine under `deploy()` and `gkm deploy`. It never prompts and never
-* exits: credentials come from `ctx.credentials`, progress goes to
-* `ctx.emit` and to `output`, and every failure is thrown.
-*
-* @internal
-*/
-async function runDeploy(source, request, ctx) {
-	const { stage } = request;
-	const redactor = ctx.redactor ?? new Redactor();
-	const emit = (event) => ctx.emit(event.type === "log" ? {
-		...event,
-		message: redactor.redact(event.message)
-	} : event);
-	/** Run one phase between its events. */
-	const phase = async (name, body) => {
-		ctx.signal?.throwIfAborted();
-		emit({
-			type: "phase.started",
-			phase: name
-		});
-		try {
-			const value = await body();
-			emit({
-				type: "phase.finished",
-				phase: name
-			});
-			return value;
-		} catch (error) {
-			emit({
-				type: "phase.failed",
-				phase: name,
-				error: eventError(error)
-			});
-			throw error;
-		}
-	};
-	ctx.signal?.throwIfAborted();
-	emit({
-		type: "phase.started",
-		phase: "validate"
-	});
-	let prepared;
-	try {
-		prepared = await prepare(source, request, ctx, emit, redactor);
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-	const { resolved, phaseCtx, store } = prepared;
-	const { target } = resolved;
-	const resources = !ctx.buildOnly && !request.skipResources && phaseCtx.stage !== phaseCtx.workspace.stages.local;
-	const provision = async () => {
-		if (!request.skipDns && resolved.target.runtime === "server") try {
-			await dnsCredentials(phaseCtx.stage, stageDnsDomains(phaseCtx.stage, phaseCtx.workspace.domains, phaseCtx.workspace.dns), ctx.credentials);
-		} catch (error) {
-			emit({
-				type: "phase.failed",
-				phase: "validate",
-				error: eventError(error)
-			});
-			throw error;
-		}
-		await provisionResources(phaseCtx, request, ctx, store, emit);
-	};
-	if (ctx.dryRun) {
-		if (resources) await provision();
-		if (request.resourcesOnly) return resourcesOnly(target, phaseCtx, emit);
-		const run = await validate(target, phaseCtx, emit);
-		await phase("plan", () => target.plan(phaseCtx, run));
-		return target.result(phaseCtx, run);
-	}
-	if (ctx.buildOnly) {
-		if (!target.build) throw new TargetBuildsNothing(resolved.name);
-		const run = await validate(target, phaseCtx, emit);
-		await phase("build", () => target.build(phaseCtx, run));
-		return target.result(phaseCtx, run);
-	}
-	let lock;
-	try {
-		assertStateOutlivesRun(phaseCtx.workspace, stage, "deploy");
-		lock = await store.lock(stage, { operation: "deploy" });
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-	try {
-		if (resources) await provision();
-		if (request.resourcesOnly) return resourcesOnly(target, phaseCtx, emit);
-		const run = await validate(target, phaseCtx, emit);
-		if (target.provision) await phase("provision", () => target.provision(phaseCtx, run));
-		if (target.build) await phase("build", () => target.build(phaseCtx, run));
-		let releasing = "release";
-		try {
-			await phase("release", () => target.release(phaseCtx, run));
-			releasing = "verify";
-			if (target.verify) await phase("verify", () => target.verify(phaseCtx, run));
-		} catch (error) {
-			if (ctx.signal?.aborted || !target.capabilities.rollback) throw error;
-			if (!target.rollback) throw error;
-			try {
-				await phase("rollback", () => target.rollback(phaseCtx, run, {
-					phase: releasing,
-					error
-				}));
-			} catch (rollbackError) {
-				throw new RollbackFailed(resolved.name, error, rollbackError);
-			}
-			throw error;
-		}
-		return await target.result(phaseCtx, run);
-	} finally {
-		await lock.release();
-	}
-}
-/**
-* The stage's providers, run inside the validate phase. A dry run plans them
-* and, so the checks after it see the stage as the run would leave it, reads
-* the keys they would write as placeholders.
-*/
-async function provisionResources(phaseCtx, request, ctx, store, emit) {
-	try {
-		const reports = await provisionStage({
-			workspace: phaseCtx.workspace,
-			stage: phaseCtx.stage,
-			manifest: phaseCtx.manifest,
-			runnables: phaseCtx.runnables ?? {},
-			secrets: phaseCtx.secrets,
-			state: store,
-			dryRun: ctx.dryRun,
-			...request.rotateKeys ? { rotateKeys: true } : {},
-			...request.retireOldKeys ? { retireOldKeys: true } : {},
-			...ctx.home ? { home: ctx.home } : {},
-			log: (line) => phaseCtx.logger.info(line)
-		});
-		if (!ctx.dryRun) return;
-		const planned = reports.flatMap((r) => r.planned);
-		if (planned.length === 0) return;
-		const secrets = phaseCtx.secrets;
-		phaseCtx.secrets = {
-			...secrets,
-			async read() {
-				const stored = await secrets.read() ?? initStageSecrets(phaseCtx.stage);
-				const custom = { ...stored.custom };
-				for (const key of planned) custom[key] ??= PLANNED_BY_THE_DEPLOY;
-				return {
-					...stored,
-					custom
-				};
-			}
-		};
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-}
-/** What a dry run reads for a key its providers would write. */
-const PLANNED_BY_THE_DEPLOY = "s3://planned-by-this-deploy";
-/** `--resources-only`: the target's own resources, and nothing else. */
-async function resourcesOnly(target, phaseCtx, emit) {
-	try {
-		if (target.resources) await target.resources(phaseCtx);
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-	emit({
-		type: "phase.finished",
-		phase: "validate"
-	});
-	return resourcesResult(phaseCtx);
-}
-/** A `--resources-only` run: no app was deployed. */
-function resourcesResult(phaseCtx) {
-	return {
-		apps: [],
-		projectId: "",
-		successCount: 0,
-		failedCount: 0,
-		stage: phaseCtx.stage,
-		identity: phaseCtx.identity.key,
-		tag: phaseCtx.tag,
-		dryRun: phaseCtx.dryRun,
-		environmentId: "",
-		skipped: [...phaseCtx.skipped],
-		urls: {},
-		changes: []
-	};
-}
-/** `validate`, then the run's `deploy.started`, inside the validate phase. */
-async function validate(target, phaseCtx, emit) {
-	try {
-		const run = await target.validate(phaseCtx);
-		const skipped = new Set(phaseCtx.skipped.map((s) => s.app));
-		emit({
-			type: "deploy.started",
-			stage: phaseCtx.stage,
-			target: phaseCtx.target,
-			identity: phaseCtx.identity.key,
-			tag: phaseCtx.tag,
-			apps: phaseCtx.apps.filter((app) => !skipped.has(app)),
-			dryRun: phaseCtx.dryRun
-		});
-		emit({
-			type: "phase.finished",
-			phase: "validate"
-		});
-		return run;
-	} catch (error) {
-		emit({
-			type: "phase.failed",
-			phase: "validate",
-			error: eventError(error)
-		});
-		throw error;
-	}
-}
-/** Everything the phases are handed, worked out before the first of them. */
-async function prepare(source, request, ctx, emit, redactor) {
-	const { stage } = request;
-	if (request.resourcesOnly && request.skipResources) throw new ResourcesOnlyAndSkipped();
-	const configured = typeof source === "function" ? await source() : source;
-	const local = stage === configured.stages.local;
-	if (!local) assertDeployedStage(configured.stages, stage);
-	const targetName = request.target ?? configured.deploy?.default ?? "dokploy";
-	const resolved = await resolveTarget(targetName, {
-		workspace: configured,
-		stage,
-		...ctx.targets ? { host: ctx.targets } : {}
-	});
-	if (local && !resolved.target.capabilities.localStage) assertDeployedStage(configured.stages, stage);
-	const options = await parseTargetOptions(resolved);
-	const allowDevServices = request.allowDevServices === true;
-	if (allowDevServices && resolved.target.runtime === "aws") throw new DevServicesNeedServerTarget(targetName);
-	const runnables = {};
-	const background = {};
-	const manifest = await discover({
-		patterns: constructGlobs(configured),
-		cwd: configured.root,
-		runnables,
-		background
-	});
-	resolveStageTelemetry({
-		...configured.deploy?.telemetry ? { telemetry: configured.deploy.telemetry } : {},
-		stage,
-		local,
-		target: targetName,
-		runtime: resolved.target.runtime,
-		selfHosted: resolved.target.capabilities.selfHostedTelemetry === true,
-		used: usesTelemetry(manifest)
-	});
-	const units = derivedApps(manifest, configured);
-	const workspace = Object.keys(units).length > 0 ? {
-		...configured,
-		apps: units
-	} : configured;
-	const identity = deployIdentity(workspace, stage);
-	const tag = request.tag ?? (resolved.target.tag ? await resolved.target.tag({
-		cwd: workspace.root,
-		stage
-	}) : generateTag(stage));
-	const buildOrder = getAppBuildOrder(workspace);
-	let selected = buildOrder;
-	if (request.apps && request.apps.length > 0) {
-		const unknown = request.apps.filter((name) => !workspace.apps[name]);
-		if (unknown.length > 0) throw new UnknownDeployApps(unknown, Object.keys(workspace.apps));
-		selected = buildOrder.filter((name) => request.apps.includes(name));
-	}
-	const skipped = [];
-	const skip = (app, reason) => {
-		skipped.push({
-			app,
-			reason
-		});
-		emit({
-			type: "app.skipped",
-			app,
-			reason
-		});
-	};
-	const byDefault = configured.deploy?.default ?? "dokploy";
-	const apps = selected.filter((name) => {
-		const own = workspace.apps[name].resolvedDeployTarget;
-		const deploysThrough = own === byDefault ? targetName : own;
-		if (deploysThrough === targetName) return true;
-		skip(name, elsewhere(deploysThrough, stage));
-		return false;
-	});
-	if (apps.length === 0) throw new NoDeployableApps(stage, targetName);
-	const store = await createStateStore({
-		config: workspace.state,
-		workspaceRoot: workspace.root,
-		workspaceName: workspace.name
-	});
-	const secrets = await deploySecrets(workspace, stage, redactor, { ...ctx.home ? { home: ctx.home } : {} });
-	const line = (level) => (message) => emit({
-		type: "log",
-		level,
-		message
-	});
-	const logger = {
-		info: line("info"),
-		warn: line("warn"),
-		error: line("error")
-	};
-	return {
-		resolved,
-		phaseCtx: {
-			target: targetName,
-			cwd: workspace.root,
-			stage,
-			tag,
-			tagGiven: request.tag !== void 0,
-			apps,
-			skipped,
-			identity,
-			workspace,
-			manifest,
-			runnables,
-			background,
-			options,
-			dryRun: ctx.dryRun,
-			atomic: request.atomic ?? false,
-			allowDevServices,
-			...request.skipDns ? { skipDns: true } : {},
-			...request.skipResources ? { skipResources: true } : {},
-			credentials: ctx.credentials,
-			state: store,
-			secrets,
-			logger,
-			signal: ctx.signal ?? new AbortController().signal,
-			childOutput: ctx.childOutput ?? "inherit",
-			emit,
-			skip,
-			name: (resource) => applicationName(identity, resource)
-		},
-		store
-	};
-}
-//#endregion
-//#region src/deploy/deploy.ts
-/**
-* `deploy()`: a deploy as a library call.
-*
-* `gkm deploy` could only be driven from an interactive terminal: it prompted
-* for what it lacked and exited the process on failure, worked out of
-* `process.cwd()`, and reported progress by printing. Here the caller says
-* where the project is, hands over the credentials and a signal, and gets back
-* a run — events to iterate while it goes, and a structured result at the end.
-* Nothing below this asks a person anything or ends the process; `gkm deploy`
-* is a thin wrapper that does both.
-*/
-/**
-* Every event a run emits, kept so that each iteration — however late it
-* starts — sees the run from its first event to its last.
-*/
-var EventLog = class {
-	events = [];
-	closed = false;
-	waiting = [];
-	push(event) {
-		this.events.push(event);
-		this.wake();
-	}
-	close() {
-		this.closed = true;
-		this.wake();
-	}
-	wake() {
-		const waiting = this.waiting;
-		this.waiting = [];
-		for (const resume of waiting) resume();
-	}
-	async *iterate() {
-		let next = 0;
-		while (true) if (next < this.events.length) yield this.events[next++];
-		else if (this.closed) return;
-		else await new Promise((resume) => this.waiting.push(resume));
-	}
-};
-function forward(logger, level, message) {
-	if (!logger) return;
-	if (level === "info") logger.info(message);
-	else if (level === "error" && logger.error) logger.error(message);
-	else logger.warn(message);
-}
-/**
-* Deploy a project's stage.
-*
-* ```ts
-* import { deploy } from '@geekmidas/cli/deploy';
-*
-* const run = deploy({ cwd: '/srv/checkouts/shop', stage: 'production' });
-* for await (const event of run) {
-*   if (event.type === 'app.deployed') console.log(event.app, event.url);
-* }
-* const result = await run.result;
-* ```
-*
-* The run starts at once; iterating it is optional, and an iteration started
-* late still sees every event from the first.
-*/
-function deploy(input) {
-	const log = new EventLog();
-	const redactor = new Redactor();
-	const emit = (event) => {
-		const masked = event.type === "log" ? {
-			...event,
-			message: redactor.redact(event.message)
-		} : event;
-		log.push(masked);
-		if (masked.type === "log") forward(input.logger, masked.level, masked.message);
-	};
-	const ctx = {
-		emit,
-		credentials: input.credentials ?? storedCredentials({ home: input.home ?? gkmHome() }),
-		dryRun: input.dryRun ?? false,
-		...input.buildOnly ? { buildOnly: true } : {},
-		home: input.home ?? gkmHome(),
-		redactor,
-		...input.signal ? { signal: input.signal } : {},
-		...input.childOutput ? { childOutput: input.childOutput } : {},
-		...input.targets ? { targets: input.targets } : {}
-	};
-	const result = withOutput((level, message) => emit({
-		type: "log",
-		level,
-		message
-	}), async () => {
-		try {
-			input.signal?.throwIfAborted();
-			const sandbox = input.sandbox ?? new LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });
-			const deployed = await withSandbox(sandbox, () => runDeploy(() => load(input, sandbox), {
-				stage: input.stage,
-				...input.target ? { target: input.target } : {},
-				...input.tag ? { tag: input.tag } : {},
-				...input.apps ? { apps: input.apps } : {},
-				...input.atomic ? { atomic: true } : {},
-				...input.allowDevServices ? { allowDevServices: input.allowDevServices } : {},
-				...input.skipDns ? { skipDns: true } : {},
-				...input.resourcesOnly ? { resourcesOnly: true } : {},
-				...input.skipResources ? { skipResources: true } : {},
-				...input.rotateKeys ? { rotateKeys: true } : {},
-				...input.retireOldKeys ? { retireOldKeys: true } : {}
-			}, ctx));
-			emit({
-				type: "deploy.finished",
-				result: deployed
-			});
-			return deployed;
-		} catch (error) {
-			emit({
-				type: "deploy.failed",
-				error: eventError(error)
-			});
-			throw error;
-		} finally {
-			log.close();
-		}
-	});
-	result.catch(() => {});
-	return {
-		result,
-		[Symbol.asyncIterator]: () => log.iterate()
-	};
-}
-/**
-* The workspace at `input.cwd`. The stage is checked by the run, once it
-* knows the target: one that runs on this machine may take the local stage.
-*/
-async function load(input, sandbox) {
-	const { workspace } = await loadWorkspaceConfig(resolve(input.cwd), { sandbox });
-	return workspace;
-}
-//#endregion
-export { UnknownDeployApps as a, TargetBuildsNothing as i, NoDeployableApps as n, RollbackFailed as r, deploy as t };
-
-//# sourceMappingURL=deploy-CeJ5D0xn.mjs.map