@stacksjs/buddy 0.70.192 → 0.70.194

package/dist/commands/deploy.d.ts

@@ -53,6 +53,13 @@ export declare function mergeSiteDeployEnv(sites: Record<string, any>, resolvedD
  * bare `user@host` (e.g. mail identities) is left alone. Production is untouched.
  */
 export declare function applyEnvironmentToSites(sites: Record<string, any>, environment: string, config: any): Record<string, any>;
+/**
+ * Load the ts-cloud driver used by Buddy. Published installs use the declared
+ * package dependency. Framework and ts-cloud development can point at a built
+ * local module with TS_CLOUD_MODULE, avoiding stale nested dependency copies
+ * while still exercising the exact Buddy deploy path.
+ */
+export declare function loadTsCloudDeployApi(): Promise<typeof import('@stacksjs/ts-cloud')>;
 /**
  * Loopback-bound server-app sites (e.g. the `api` site: env.HOST=127.0.0.1,
  * reached only through `buddy serve`'s same-origin /api proxy on :3000 —

package/dist/commands/deploy.js

@@ -1,7 +1,8 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, relative } from "node:path";
+import { isAbsolute, join, relative, resolve } from "node:path";
 import process from "node:process";
+import { pathToFileURL } from "node:url";
 import { runAction } from "@stacksjs/actions";
 import { italic, onUnknownSubcommand, outro, prompts, runCommand } from "@stacksjs/cli";
 import { app, dns as dnsConfig, email as emailConfig, cloud as cloudConfig } from "@stacksjs/config";
@@ -545,15 +546,24 @@ async function deployToHetzner(tsCloudConfig, deployEnv, options) {
     log.info("Generate one with:  ssh-keygen -t ed25519");
     process.exit(ExitCode.FatalError);
   }
-  const { createCloudDriver, deployAllComputeSites, resolveSiteKind } = await import("@stacksjs/ts-cloud");
+  const { createCloudDriver, deployAllComputeSites, ensureManagementDashboard, resolveSiteKind } = await loadTsCloudDeployApi();
   try {
-    await runHetznerDeploy({ tsCloudConfig, environment, verbose, docker: options.docker === !0, createCloudDriver, deployAllComputeSites, resolveSiteKind, onlySite: options.site || void 0 });
+    await runHetznerDeploy({ tsCloudConfig, environment, verbose, docker: options.docker === !0, createCloudDriver, deployAllComputeSites, ensureManagementDashboard, resolveSiteKind, onlySite: options.site || void 0 });
   } catch (err) {
     log.error("Hetzner deploy failed:");
     console.error(err instanceof Error ? err.stack || err.message : err);
     process.exit(ExitCode.FatalError);
   }
 }
+export async function loadTsCloudDeployApi() {
+  const requested = process.env.TS_CLOUD_MODULE?.trim();
+  if (!requested)
+    return import("@stacksjs/ts-cloud");
+  const modulePath = isAbsolute(requested) ? requested : resolve(process.cwd(), requested);
+  if (!existsSync(modulePath))
+    throw Error(`TS_CLOUD_MODULE points to a missing module: ${modulePath}`);
+  return import(pathToFileURL(modulePath).href);
+}
 export function scrubLoopbackSitePortsForFirewall(tsCloudConfig) {
   const sites = tsCloudConfig?.sites;
   if (!sites)
@@ -652,7 +662,7 @@ async function startGithubDeployments(args) {
   return records;
 }
 async function runHetznerDeploy(args) {
-  const { tsCloudConfig, environment, verbose, docker, createCloudDriver, deployAllComputeSites, resolveSiteKind, onlySite } = args, startTime = performance.now();
+  const { tsCloudConfig, environment, verbose, docker, createCloudDriver, deployAllComputeSites, ensureManagementDashboard, resolveSiteKind, onlySite } = args, startTime = performance.now();
   console.log("");
   console.log("\uD83D\uDE80 Deploy \u2192 Hetzner Cloud");
   console.log("");
@@ -661,7 +671,6 @@ async function runHetznerDeploy(args) {
   log.info(`Location: ${tsCloudConfig.hetzner?.location || process.env.HCLOUD_LOCATION || "fsn1"}`);
   log.info(`Size: ${tsCloudConfig.infrastructure?.compute?.size || "small"}`);
   try {
-    const { ensureManagementDashboard } = await import("@stacksjs/ts-cloud");
     if (typeof ensureManagementDashboard === "function")
       ensureManagementDashboard(tsCloudConfig, {
         cwd: process.cwd(),
@@ -780,6 +789,7 @@ async function runHetznerDeploy(args) {
   log.info(onlySite ? `Shipping site '${onlySite}' to the server...` : "Shipping release to the server...");
   const deployConfig = onlySite ? { ...tsCloudConfig, sites: { [onlySite]: sitesWithResolvedEnv[onlySite] } } : { ...tsCloudConfig, sites: sitesWithResolvedEnv }, ok = await deployAllComputeSites({
     config: deployConfig,
+    managementDashboard: !1,
     rpxConfig: { ...tsCloudConfig, sites: sitesWithResolvedEnv },
     environment,
     driver,
@@ -900,8 +910,8 @@ ENV_CHANGED=0
 # The 'user:local' CLI is direct-DB and does NOT read /etc/mail/mail.env, so
 # without SMTP_DB_PATH it writes to ./smtp.db (the SSH cwd) \u2014 a phantom DB the
 # running server never reads, and auth silently 535s. Point it at the real DB.
-export SMTP_DB_PATH="$(grep -E '^SMTP_DB_PATH=' "$ENVF" 2>/dev/null | head -1 | cut -d= -f2- || true)"
-[ -z "$SMTP_DB_PATH" ] && export SMTP_DB_PATH=/opt/mail/smtp.db
+MAIL_DB_PATH="$(grep -E '^SMTP_DB_PATH=' "$ENVF" 2>/dev/null | head -1 | cut -d= -f2- || true)"
+[ -z "$MAIL_DB_PATH" ] && MAIL_DB_PATH=/opt/mail/smtp.db
 echo "MAILHOST:$(grep -E '^SMTP_HOSTNAME=' "$ENVF" 2>/dev/null | head -1 | cut -d= -f2- || true)"
 # 1) Register the local delivery domain (merge into SMTP_LOCAL_DOMAINS).
 if [ -n "$DOMAIN" ] && [ -f "$ENVF" ]; then
@@ -944,8 +954,48 @@ if [ -n "$BOXES_B64" ] && [ -x "$MS" ]; then
     [ -z "$addr" ] && continue
     # NOTE: 'user:local info' exits 0 even when the user is absent (it only
     # prints "not found"), so existence is decided from the OUTPUT, not $?.
-    if "$MS" user:local info "$addr" 2>&1 | grep -qi 'not found'; then
-      if "$MS" user:local create "$addr" "$pw" "$addr" >/dev/null 2>&1; then echo "MADE:$addr"; else echo "FAIL:$addr"; fi
+    if SMTP_DB_PATH="$MAIL_DB_PATH" "$MS" user:local info "$addr" 2>&1 | grep -qi 'not found'; then
+      legacy="\${addr%%@*}"
+      # Older single-domain installs used a bare username whose email is this
+      # full address. Creating the isolated address then hits users.email's
+      # UNIQUE constraint while the CLI still exits zero. Perform mail's
+      # documented username migration transactionally, including every
+      # username-keyed table, before falling back to a true create.
+      migrated=$(MAIL_DB_PATH="$MAIL_DB_PATH" OLD_USERNAME="$legacy" NEW_USERNAME="$addr" /usr/local/bin/bun --bun -e '
+        const { Database } = require("bun:sqlite")
+        const db = new Database(process.env.MAIL_DB_PATH)
+        const oldName = process.env.OLD_USERNAME
+        const newName = process.env.NEW_USERNAME
+        const oldUser = db.query("SELECT 1 AS found FROM users WHERE username=? AND email=?").get(oldName, newName)
+        const newUser = db.query("SELECT 1 AS found FROM users WHERE username=?").get(newName)
+        if (oldUser && !newUser) {
+          db.transaction(() => {
+            for (const table of ["users", "imap_mailboxes", "imap_uids", "webmail_sessions"])
+              db.query("UPDATE " + table + " SET username=? WHERE username=?").run(newName, oldName)
+          })()
+          process.stdout.write("yes")
+        }
+        db.close()
+      ' 2>/dev/null || true)
+      if [ "$migrated" = yes ]; then
+        if [ -d "/opt/mail/mail/$legacy" ] && [ ! -e "/opt/mail/mail/$addr" ]; then
+          mv -- "/opt/mail/mail/$legacy" "/opt/mail/mail/$addr"
+          chown -R mail-server:mail-server "/opt/mail/mail/$addr"
+        fi
+        # The declared config password becomes authoritative after migration.
+        SMTP_DB_PATH="$MAIL_DB_PATH" "$MS" user:local change-password "$addr" "$pw" >/dev/null 2>&1 || true
+      else
+        # The CLI action historically returned zero even when an internal
+        # create failed. Pin the live DB for both calls and verify the row.
+        SMTP_DB_PATH="$MAIL_DB_PATH" "$MS" user:local create "$addr" "$pw" "$addr" >/dev/null 2>&1 || true
+      fi
+      if SMTP_DB_PATH="$MAIL_DB_PATH" "$MS" user:local info "$addr" 2>&1 | grep -qi 'not found'; then
+        echo "FAIL:$addr"
+      elif [ "$migrated" = yes ]; then
+        echo "MIGRATED:$addr"
+      else
+        echo "MADE:$addr"
+      fi
     else
       echo "EXISTS:$addr"
     fi
@@ -1076,7 +1126,7 @@ if [ "$ENV_CHANGED" = 1 ]; then systemctl restart mail 2>/dev/null || true; echo
       input: script,
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
-    }), line = (out.match(/MAILTENANT:[^\n]*/) || [])[0] || "MAILTENANT:done", mailHostFromOut = (out.match(/MAILHOST:([^\n]*)/) || [])[1]?.trim(), mailHost = mailHostFromOut || `mail.${domain}`, dkimPubB64 = (out.match(/DKIMPUB:([^\n]*)/) || [])[1]?.trim() || void 0, madeAddrs = new Set([...out.matchAll(/MADE:([^\n]+)/g)].flatMap((m) => m[1] ? [m[1].trim()] : [])), created = boxes.filter((b) => madeAddrs.has(b.address)).map((b) => ({ address: b.address, password: b.password }));
+    }), line = (out.match(/MAILTENANT:[^\n]*/) || [])[0] || "MAILTENANT:done", mailHostFromOut = (out.match(/MAILHOST:([^\n]*)/) || [])[1]?.trim(), mailHost = mailHostFromOut || `mail.${domain}`, dkimPubB64 = (out.match(/DKIMPUB:([^\n]*)/) || [])[1]?.trim() || void 0, madeAddrs = new Set([...out.matchAll(/MADE:([^\n]+)/g)].flatMap((m) => m[1] ? [m[1].trim()] : [])), migratedAddrs = new Set([...out.matchAll(/MIGRATED:([^\n]+)/g)].flatMap((m) => m[1] ? [m[1].trim()] : [])), created = boxes.filter((b) => madeAddrs.has(b.address)).map((b) => ({ address: b.address, password: b.password }));
     logger.success(`Mail routing reconciled (${line.replace("MAILTENANT:", "")})`);
     const failed = [...out.matchAll(/FAIL:([^\n]+)/g)].flatMap((m) => m[1] ? [m[1].trim()] : []);
     if (failed.length)
@@ -1090,7 +1140,7 @@ if [ "$ENV_CHANGED" = 1 ]; then systemctl restart mail 2>/dev/null || true; echo
     const certError = (out.match(/CERTFAIL:([^\n]*)/) || [])[1]?.trim();
     if (certError)
       logger.warn(`Mail: could not issue a certificate for mail.${domain} (clients should use ${mailHostFromOut || "the shared mail host"}): ${certError}`);
-    const seen = new Set([...madeAddrs, ...[...out.matchAll(/EXISTS:([^\n]+)/g)].flatMap((m) => m[1] ? [m[1].trim()] : [])]), unaccounted = boxes.filter((b) => !seen.has(b.address)).map((b) => b.address);
+    const seen = new Set([...madeAddrs, ...migratedAddrs, ...[...out.matchAll(/EXISTS:([^\n]+)/g)].flatMap((m) => m[1] ? [m[1].trim()] : [])]), unaccounted = boxes.filter((b) => !seen.has(b.address)).map((b) => b.address);
     if (unaccounted.length)
       logger.warn(`Mail: ${unaccounted.length} declared mailbox(es) were not reconciled: ${unaccounted.join(", ")}`);
     if (created.length) {
@@ -1098,6 +1148,8 @@ if [ "$ENV_CHANGED" = 1 ]; then systemctl restart mail 2>/dev/null || true; echo
       for (const b of created)
         logger.info(`  ${b.address}  ${b.password}`);
     }
+    if (migratedAddrs.size)
+      logger.success(`Mail: migrated ${migratedAddrs.size} legacy mailbox username(s) to isolated full addresses`);
     return domain ? { domain, mailHost, dkimPubB64, created } : null;
   } catch (err) {
     logger.warn(`Mail routing reconcile skipped: ${getErrorMessage(err)}`);

package/dist/commands/docs/buddy-commands.js

@@ -8,6 +8,11 @@ function markdown(value) {
 function code(value) {
   return `\`${String(value).replaceAll("`", "\\`")}\``;
 }
+function stablePath(value) {
+  if (typeof value !== "string" || !value.includes(root))
+    return value;
+  return value.replaceAll(root, "<project root>");
+}
 function optionFlags(option) {
   return option.flags.map((flag) => code(`${flag.length === 1 ? "-" : "--"}${flag}`)).join(", ");
 }
@@ -34,7 +39,7 @@ function commandSection(command) {
     `- Arguments: ${command.arguments.length ? command.arguments.map(argumentSyntax).join(", ") : "none"}`
   ];
   if (command.options.length)
-    lines.push("", "| Option | Description | Contract | Default |", "| --- | --- | --- | --- |", ...command.options.map((option) => `| ${optionFlags(option)} | ${markdown(option.description || "\u2014")} | ${optionKind(option)} | ${option.default === void 0 ? "\u2014" : code(JSON.stringify(option.default))} |`));
+    lines.push("", "| Option | Description | Contract | Default |", "| --- | --- | --- | --- |", ...command.options.map((option) => `| ${optionFlags(option)} | ${markdown(option.description || "\u2014")} | ${optionKind(option)} | ${option.default === void 0 ? "\u2014" : code(JSON.stringify(stablePath(option.default)))} |`));
   if (command.examples.length)
     lines.push("", "Examples:", "", "```bash", ...command.examples, "```");
   return lines.join(`
@@ -107,8 +112,20 @@ export async function run() {
   } else {
     if (!existsSync(outputPath))
       throw Error("Buddy command reference is missing; run bun run docs:buddy");
-    if (readFileSync(outputPath, "utf8") !== expected)
-      throw Error("Buddy command reference is stale; run bun run docs:buddy");
+    const current = readFileSync(outputPath, "utf8");
+    if (current !== expected) {
+      const currentLines = current.split(`
+`), expectedLines = expected.split(`
+`), differences = [];
+      for (let i = 0;i < Math.max(currentLines.length, expectedLines.length) && differences.length < 6; i++)
+        if (currentLines[i] !== expectedLines[i])
+          differences.push(`  line ${i + 1}:
+    committed: ${JSON.stringify(currentLines[i] ?? "<end of file>")}
+    generated: ${JSON.stringify(expectedLines[i] ?? "<end of file>")}`);
+      throw Error(`Buddy command reference is stale; run bun run docs:buddy
+${differences.join(`
+`)}`);
+    }
     console.log("Buddy command reference matches the runtime registry");
   }
 }

package/dist/commands/doctor.js

@@ -1,3 +1,5 @@
+import { lstatSync, readlinkSync } from "node:fs";
+import { resolve } from "node:path";
 import process from "node:process";
 import { bold, dim, green, intro, log, onUnknownSubcommand, red, yellow } from "@stacksjs/cli";
 import { feature } from "@stacksjs/config";
@@ -30,7 +32,25 @@ export function doctor(buddy) {
   buddy.command("doctor", "Run health checks on your Stacks installation").option("--no-fail", "Print results but always exit 0 (CI ramp-up)").action(async (options) => {
     log.debug("Running `buddy doctor` ...");
     await intro("buddy doctor");
-    const checks = [], bunVersion = process.versions.bun;
+    const checks = [], modulesPath = resolve(process.cwd(), "node_modules");
+    try {
+      if (lstatSync(modulesPath).isSymbolicLink()) {
+        const target = resolve(process.cwd(), readlinkSync(modulesPath)), insideProject = target.startsWith(`${resolve(process.cwd())}/`);
+        checks.push({
+          name: "Dependency tree",
+          status: insideProject ? "warn" : "fail",
+          message: insideProject ? `node_modules is a symlink to ${target}` : `node_modules is a symlink to ${target}, which belongs to another project \u2014 installs here mutate it, and what runs locally is not what the lockfile resolves. Remove the link and run \`bun install\`.`
+        });
+      } else
+        checks.push({ name: "Dependency tree", status: "pass", message: "node_modules is this project's own" });
+    } catch {
+      checks.push({
+        name: "Dependency tree",
+        status: "warn",
+        message: "node_modules is missing \u2014 run `bun install`"
+      });
+    }
+    const bunVersion = process.versions.bun;
     if (bunVersion && isSupportedBunVersion(bunVersion))
       checks.push({
         name: "Bun Runtime",
@@ -424,8 +444,10 @@ export function doctor(buddy) {
     log.info("");
     if (hasFailures) {
       log.error("Some critical checks failed. Please address the issues above.");
-      if (options?.fail !== !1)
+      if (options?.fail !== !1) {
+        await log.flush();
         process.exit(1);
+      }
     } else if (hasWarnings)
       log.info(yellow("Some checks have warnings. Your system should work but may have issues."));
     else

package/dist/commands/protocol/source-manifest.js

@@ -19,7 +19,7 @@ function showJson(sourceRevision, path) {
 function category(path) {
   if (/(^|\/)(test|tests|__tests__)(\/|$)|\.(test|spec)\.[^.]+$/.test(path))
     return "tests";
-  if (path.startsWith("protocol/suite/"))
+  if (path.startsWith(".github/protocol/suite/"))
     return "vendored-protocol";
   if (/(^|\/)(dist|generated|coverage)(\/|$)|\.d\.ts$/.test(path))
     return "generated";
@@ -58,7 +58,7 @@ export function buildSourceManifest(requestedRevision) {
     if (!pkg.name || !pkg.version)
       return [];
     return [{ name: pkg.name, path, version: pkg.version, publishable: pkg.private !== !0 }];
-  }).sort((a, b) => a.name.localeCompare(b.name) || a.path.localeCompare(b.path)), rootPackage = showJson(sourceRevision, "package.json"), suiteLock = showJson(sourceRevision, "protocol/suite.lock.json");
+  }).sort((a, b) => a.name.localeCompare(b.name) || a.path.localeCompare(b.path)), rootPackage = showJson(sourceRevision, "package.json"), suiteLock = showJson(sourceRevision, ".github/protocol/suite.lock.json");
   return {
     schemaVersion: "1.0.0",
     repository: "https://github.com/stacksjs/stacks",

package/dist/commands/serve.js

@@ -169,9 +169,15 @@ export function serveApi(buddy) {
     if (options?.port)
       process.env.PORT = String(options.port);
     process.env.APP_ENV = process.env.APP_ENV || "production";
-    await import("@stacksjs/actions/serve/api");
+    await import(resolveApiEntry());
   });
 }
+function resolveApiEntry() {
+  const vendored = join(process.cwd(), "storage/framework/core/actions/src/serve/api.ts");
+  if (existsSync(vendored))
+    return vendored;
+  return "@stacksjs/actions/serve/api";
+}
 function resolveDefaultsResources() {
   const vendored = "storage/framework/defaults/resources";
   if (existsSync(vendored))

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/buddy",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.192",
+  "version": "0.70.194",
   "description": "Meet Buddy. The Stacks runtime.",
   "author": "Chris Breuer",
   "contributors": [
@@ -137,7 +137,7 @@
     "@stacksjs/ui": "^0.70.180",
     "@stacksjs/utils": "^0.70.180",
     "@stacksjs/validation": "^0.70.180",
-    "@stacksjs/ts-cloud": "^0.7.60",
+    "@stacksjs/ts-cloud": "^0.7.78",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1"
   },