@stacksjs/buddy 0.72.67 → 0.72.69

package/dist/commands/deploy.js

@@ -45,7 +45,7 @@ rm -f /etc/systemd/system/mail-health.service /etc/systemd/system/mail-health.ti
 rm -f /usr/local/sbin/mail-health-check /etc/systemd/system/mail.service.d/reliability.conf
 rmdir /etc/systemd/system/mail.service.d 2>/dev/null || true
 systemctl daemon-reload
-systemctl reset-failed`;try{execSync(`ssh ${sshArgs.map((a)=>`'${a}'`).join(" ")} bash -s`,{input:script,encoding:"utf8",stdio:["pipe","pipe","pipe"]});logger.success("Mail: removed the detached health timer from the application box")}catch(err){logger.warn(`Mail: could not remove the detached health timer: ${getErrorMessage(err)}`)}}export function resolveHetznerApiToken(tsCloudConfig){return tsCloudConfig?.hetzner?.apiToken||process.env.HCLOUD_TOKEN||process.env.HETZNER_API_TOKEN}export function describeAttachLookupFailure(owner,environment,failure){if(failure?.kind==="no-token")return`Attach target '${owner}': no Hetzner API token to look it up with, so no lookup was attempted. Set HCLOUD_TOKEN (or HETZNER_API_TOKEN, or hetzner.apiToken in config/cloud.ts).`;if(failure?.kind==="request-failed"){const where=failure.status>0?`returned HTTP ${failure.status}`:"could not be reached";return`Attach target '${owner}': the Hetzner API ${where}, so whether the box exists is unknown.`+(failure.detail?` ${failure.detail}`:"")+(failure.status===401||failure.status===403?" That is an auth failure, not a missing server: check the token is valid for this Hetzner project.":"")}return`Attach target '${owner}' has no reachable box for '${environment}'. Nothing matched ts-cloud/project=${owner},ts-cloud/environment=${environment},ts-cloud/role=app, and no server is named '${owner}-${environment}-app'. Is it provisioned (by its owner)?`}export async function resolveAttachTargetBox(owner,environment,tsCloudConfig){const token=resolveHetznerApiToken(tsCloudConfig);if(!token)return{box:null,failure:{kind:"no-token"}};const pick=(servers)=>servers.find((s)=>s?.status!=="off"&&s?.public_net?.ipv4?.ip)||servers[0];let requestFailure;const req=async(qs)=>{try{const res=await fetch(`https://api.hetzner.cloud/v1/servers?${qs}`,{headers:{Authorization:`Bearer ${token}`}});if(!res.ok){const body=await res.text().catch(()=>"");requestFailure??={kind:"request-failed",status:res.status,detail:pollFailureDetail(body)};return[]}return(await res.json()).servers||[]}catch(err){requestFailure??={kind:"request-failed",status:0,detail:pollFailureDetail(getErrorMessage(err))};return[]}},byLabel=await req(`label_selector=${encodeURIComponent(`ts-cloud/project=${owner},ts-cloud/environment=${environment},ts-cloud/role=app`)}`),chosen=pick(byLabel)||pick(await req(`name=${encodeURIComponent(`${owner}-${environment}-app`)}`));if(!chosen)return{box:null,failure:requestFailure??{kind:"no-match"}};const{normalizePublicIpv6}=await import("@stacksjs/ts-cloud");if(typeof normalizePublicIpv6!=="function")log.warn("DNS: @stacksjs/ts-cloud does not export normalizePublicIpv6 - AAAA records will be skipped. Upgrade ts-cloud.");const reportedIpv6=chosen.public_net?.ipv6?.ip;return{box:{serverId:chosen.id,serverName:chosen.name,publicIp:chosen.public_net?.ipv4?.ip,publicIpv6:typeof normalizePublicIpv6==="function"?normalizePublicIpv6(reportedIpv6):void 0}}}export async function provisionMailTenant(ip,logger){if(!hasExplicitEmailConfig())return null;const cfg=emailConfig||{};if(cfg.server?.enabled===!1)return null;const domain=cfg.domain||(typeof cfg.from?.address==="string"&&cfg.from.address.includes("@")?cfg.from.address.split("@")[1]:void 0),declaredForwards=cfg.forwards&&typeof cfg.forwards==="object"?cfg.forwards:{},forwards={...declaredForwards},declaredBoxes=new Set(domain?resolveMailboxes(cfg.mailboxes,domain).map((b)=>b.address):[]);for(const[key,targets]of Object.entries(declaredForwards)){const at=key.indexOf("@");if(at===-1||declaredBoxes.has(key))continue;const localPart=key.slice(0,at);if(key.slice(at+1)!==domain||forwards[localPart])continue;forwards[localPart]=targets}const hasForwards=Object.keys(forwards).length>0,generatePasswords=cfg.server?.generatePasswords===!0,resolved=domain?resolveMailboxesWithSkipped(cfg.mailboxes,domain,generatePasswords):{boxes:[],skipped:[]},boxes=resolved.boxes,generated=boxes.filter((box)=>box.generated);if(generated.length>0)try{const{setEnv}=await import("@stacksjs/env");for(const box of generated)await setEnv(`MAIL_PASSWORD_${box.localPart.replace(/[^A-Z0-9]/g,"_")}`,box.password,{file:".env.production",encrypt:!0});logger.success(`Mail: generated and saved ${generated.length} mailbox password(s) to .env.production (encrypted)`)}catch(err){logger.warn(`Mail: could not save the generated password(s) to .env.production - they are printed below and will otherwise be regenerated next deploy: ${getErrorMessage(err)}`)}if(resolved.skipped.length>0){logger.warn(`Mail: ${resolved.skipped.length} declared mailbox(es) were not created because no password was supplied: ${resolved.skipped.join(", ")}`);logger.info(`Set MAIL_PASSWORD_<LOCALPART> in the target environment (e.g. ${resolved.skipped[0]?.split("@")[0]?.toUpperCase().replace(/[^A-Z0-9]/g,"_")}) and run this again.`)}if(!domain&&!hasForwards)return null;const{execSync}=await import("node:child_process"),sshArgs=["-o","StrictHostKeyChecking=accept-new","-o","BatchMode=yes","-o","ConnectTimeout=20",`root@${ip}`],forwardsB64=hasForwards?Buffer.from(JSON.stringify(forwards)).toString("base64"):"",readme="Auto-forwarding rules, re-read on every message (edits take effect immediately, no restart). KEY = the delivered mailbox: the FULL address for per-domain isolated mailboxes (e.g. no-reply@app.com), or a bare local-part for legacy role mailboxes. VALUE = list of destination addresses; targets on a local domain are written straight to that mailbox Maildir, external targets are relayed. Managed by buddy deploy from config/email.ts (merge-based - hand edits to other keys are preserved).",readmeB64=Buffer.from(readme).toString("base64"),boxesB64=boxes.length?Buffer.from(`${boxes.map((b)=>`${b.address}	${b.password}`).join(`
+systemctl reset-failed`;try{execSync(`ssh ${sshArgs.map((a)=>`'${a}'`).join(" ")} bash -s`,{input:script,encoding:"utf8",stdio:["pipe","pipe","pipe"]});logger.success("Mail: removed the detached health timer from the application box")}catch(err){logger.warn(`Mail: could not remove the detached health timer: ${getErrorMessage(err)}`)}}export function resolveHetznerApiToken(tsCloudConfig){return tsCloudConfig?.hetzner?.apiToken||process.env.HCLOUD_TOKEN||process.env.HETZNER_API_TOKEN}export function describeAttachLookupFailure(owner,environment,failure){if(failure?.kind==="no-token")return`Attach target '${owner}': no Hetzner API token to look it up with, so no lookup was attempted. Set HCLOUD_TOKEN (or HETZNER_API_TOKEN, or hetzner.apiToken in config/cloud.ts).`;if(failure?.kind==="request-failed"){const where=failure.status>0?`returned HTTP ${failure.status}`:"could not be reached";return`Attach target '${owner}': the Hetzner API ${where}, so whether the box exists is unknown.`+(failure.detail?` ${failure.detail}`:"")+(failure.status===401||failure.status===403?" That is an auth failure, not a missing server: check the token is valid for this Hetzner project.":"")}return`Attach target '${owner}' has no reachable box for '${environment}'. Nothing matched ts-cloud/project=${owner},ts-cloud/environment=${environment},ts-cloud/role=app, and no server is named '${owner}-${environment}-app'. Is it provisioned (by its owner)?`}export async function resolveAttachTargetBox(owner,environment,tsCloudConfig){const token=resolveHetznerApiToken(tsCloudConfig);if(!token)return{box:null,failure:{kind:"no-token"}};const pick=(servers)=>servers.find((s)=>s?.status!=="off"&&s?.public_net?.ipv4?.ip)||servers[0];let requestFailure;const req=async(qs)=>{try{const res=await fetch(`https://api.hetzner.cloud/v1/servers?${qs}`,{headers:{Authorization:`Bearer ${token}`}});if(!res.ok){const body=await res.text().catch(()=>"");requestFailure??={kind:"request-failed",status:res.status,detail:pollFailureDetail(body)};return[]}return(await res.json()).servers||[]}catch(err){requestFailure??={kind:"request-failed",status:0,detail:pollFailureDetail(getErrorMessage(err))};return[]}},byLabel=await req(`label_selector=${encodeURIComponent(`ts-cloud/project=${owner},ts-cloud/environment=${environment},ts-cloud/role=app`)}`),chosen=pick(byLabel)||pick(await req(`name=${encodeURIComponent(`${owner}-${environment}-app`)}`));if(!chosen)return{box:null,failure:requestFailure??{kind:"no-match"}};const{normalizePublicIpv6}=await import("@stacksjs/ts-cloud");if(typeof normalizePublicIpv6!=="function")log.warn("DNS: @stacksjs/ts-cloud does not export normalizePublicIpv6 - AAAA records will be skipped. Upgrade ts-cloud.");const reportedIpv6=chosen.public_net?.ipv6?.ip;return{box:{serverId:chosen.id,serverName:chosen.name,publicIp:chosen.public_net?.ipv4?.ip,publicIpv6:typeof normalizePublicIpv6==="function"?normalizePublicIpv6(reportedIpv6):void 0}}}export async function provisionMailTenant(ip,logger){if(!hasExplicitEmailConfig())return null;const cfg=emailConfig||{};if(cfg.server?.enabled===!1)return null;const domain=cfg.domain||(typeof cfg.from?.address==="string"&&cfg.from.address.includes("@")?cfg.from.address.split("@")[1]:void 0),declaredForwards=cfg.forwards&&typeof cfg.forwards==="object"?cfg.forwards:{},forwards={...declaredForwards},declaredBoxes=new Set(domain?resolveMailboxes(cfg.mailboxes,domain).map((b)=>b.address):[]);for(const[key,targets]of Object.entries(declaredForwards)){const at=key.indexOf("@");if(at===-1||declaredBoxes.has(key))continue;const localPart=key.slice(0,at);if(key.slice(at+1)!==domain||forwards[localPart])continue;forwards[localPart]=targets}const hasForwards=Object.keys(forwards).length>0,generatePasswords=cfg.server?.generatePasswords===!0,resolved=domain?resolveMailboxesWithSkipped(cfg.mailboxes,domain,generatePasswords):{boxes:[],skipped:[]},boxes=resolved.boxes,generated=boxes.filter((box)=>box.generated);if(generated.length>0)try{const{setEnv}=await import("@stacksjs/env");for(const box of generated)await setEnv(`MAIL_PASSWORD_${box.localPart.replace(/[^A-Z0-9]/g,"_")}`,box.password,{file:".env.production"});logger.success(`Mail: generated and saved ${generated.length} mailbox password(s) to .env.production (encrypted)`)}catch(err){logger.warn(`Mail: could not save the generated password(s) to .env.production - they are printed below and will otherwise be regenerated next deploy: ${getErrorMessage(err)}`)}if(resolved.skipped.length>0){logger.warn(`Mail: ${resolved.skipped.length} declared mailbox(es) were not created because no password was supplied: ${resolved.skipped.join(", ")}`);logger.info(`Set MAIL_PASSWORD_<LOCALPART> in the target environment (e.g. ${resolved.skipped[0]?.split("@")[0]?.toUpperCase().replace(/[^A-Z0-9]/g,"_")}) and run this again.`)}if(!domain&&!hasForwards)return null;const{execSync}=await import("node:child_process"),sshArgs=["-o","StrictHostKeyChecking=accept-new","-o","BatchMode=yes","-o","ConnectTimeout=20",`root@${ip}`],forwardsB64=hasForwards?Buffer.from(JSON.stringify(forwards)).toString("base64"):"",readme="Auto-forwarding rules, re-read on every message (edits take effect immediately, no restart). KEY = the delivered mailbox: the FULL address for per-domain isolated mailboxes (e.g. no-reply@app.com), or a bare local-part for legacy role mailboxes. VALUE = list of destination addresses; targets on a local domain are written straight to that mailbox Maildir, external targets are relayed. Managed by buddy deploy from config/email.ts (merge-based - hand edits to other keys are preserved).",readmeB64=Buffer.from(readme).toString("base64"),boxesB64=boxes.length?Buffer.from(`${boxes.map((b)=>`${b.address}	${b.password}`).join(`
 `)}
 `).toString("base64"):"",script=`set -e
 DOMAIN=${domain?`'${domain}'`:"''"}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/buddy",
   "type": "module",
   "sideEffects": false,
-  "version": "0.72.67",
+  "version": "0.72.69",
   "description": "Meet Buddy. The Stacks runtime.",
   "author": "Chris Breuer",
   "contributors": [
@@ -95,62 +95,62 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@stacksjs/actions": "^0.72.67",
-    "@stacksjs/ai": "^0.72.67",
-    "@stacksjs/alias": "^0.72.67",
-    "@stacksjs/analytics": "^0.72.67",
-    "@stacksjs/arrays": "^0.72.67",
-    "@stacksjs/auth": "^0.72.67",
-    "@stacksjs/browser-extension": "^0.72.67",
-    "@stacksjs/build": "^0.72.67",
-    "@stacksjs/cache": "^0.72.67",
-    "@stacksjs/chat": "^0.72.67",
+    "@stacksjs/actions": "^0.72.69",
+    "@stacksjs/ai": "^0.72.69",
+    "@stacksjs/alias": "^0.72.69",
+    "@stacksjs/analytics": "^0.72.69",
+    "@stacksjs/arrays": "^0.72.69",
+    "@stacksjs/auth": "^0.72.69",
+    "@stacksjs/browser-extension": "^0.72.69",
+    "@stacksjs/build": "^0.72.69",
+    "@stacksjs/cache": "^0.72.69",
+    "@stacksjs/chat": "^0.72.69",
     "@stacksjs/clapp": "^0.2.12",
-    "@stacksjs/cli": "^0.72.67",
-    "@stacksjs/cloud": "^0.72.67",
-    "@stacksjs/cms": "^0.72.67",
-    "@stacksjs/collections": "^0.72.67",
-    "@stacksjs/config": "^0.72.67",
-    "@stacksjs/database": "^0.72.67",
-    "@stacksjs/desktop-build": "^0.72.67",
-    "@stacksjs/dns": "^0.72.67",
+    "@stacksjs/cli": "^0.72.69",
+    "@stacksjs/cloud": "^0.72.69",
+    "@stacksjs/cms": "^0.72.69",
+    "@stacksjs/collections": "^0.72.69",
+    "@stacksjs/config": "^0.72.69",
+    "@stacksjs/database": "^0.72.69",
+    "@stacksjs/desktop-build": "^0.72.69",
+    "@stacksjs/dns": "^0.72.69",
     "@stacksjs/dnsx": "^0.2.3",
-    "@stacksjs/email": "^0.72.67",
-    "@stacksjs/enums": "^0.72.67",
-    "@stacksjs/env": "^0.72.67",
-    "@stacksjs/error-handling": "^0.72.67",
-    "@stacksjs/events": "^0.72.67",
-    "@stacksjs/git": "^0.72.67",
+    "@stacksjs/email": "^0.72.69",
+    "@stacksjs/enums": "^0.72.69",
+    "@stacksjs/env": "^0.72.69",
+    "@stacksjs/error-handling": "^0.72.69",
+    "@stacksjs/events": "^0.72.69",
+    "@stacksjs/git": "^0.72.69",
     "@stacksjs/gitit": "^0.2.5",
-    "@stacksjs/health": "^0.72.67",
+    "@stacksjs/health": "^0.72.69",
     "@stacksjs/httx": "^0.1.10",
-    "@stacksjs/image": "^0.72.67",
-    "@stacksjs/lint": "^0.72.67",
-    "@stacksjs/logging": "^0.72.67",
-    "@stacksjs/notifications": "^0.72.67",
-    "@stacksjs/objects": "^0.72.67",
-    "@stacksjs/orm": "^0.72.67",
-    "@stacksjs/path": "^0.72.67",
-    "@stacksjs/payments": "^0.72.67",
-    "@stacksjs/realtime": "^0.72.67",
-    "@stacksjs/router": "^0.72.67",
+    "@stacksjs/image": "^0.72.69",
+    "@stacksjs/lint": "^0.72.69",
+    "@stacksjs/logging": "^0.72.69",
+    "@stacksjs/notifications": "^0.72.69",
+    "@stacksjs/objects": "^0.72.69",
+    "@stacksjs/orm": "^0.72.69",
+    "@stacksjs/path": "^0.72.69",
+    "@stacksjs/payments": "^0.72.69",
+    "@stacksjs/realtime": "^0.72.69",
+    "@stacksjs/router": "^0.72.69",
     "@stacksjs/rpx": "^0.11.42",
-    "@stacksjs/scheduler": "^0.72.67",
-    "@stacksjs/search-engine": "^0.72.67",
-    "@stacksjs/security": "^0.72.67",
-    "@stacksjs/server": "^0.72.67",
-    "@stacksjs/sites": "^0.72.67",
-    "@stacksjs/skills": "^0.72.67",
-    "@stacksjs/storage": "^0.72.67",
-    "@stacksjs/strings": "^0.72.67",
-    "@stacksjs/testing": "^0.72.67",
-    "@stacksjs/tinker": "^0.72.67",
-    "@stacksjs/ts-cloud": "^0.11.4",
-    "@stacksjs/tunnel": "^0.72.67",
-    "@stacksjs/types": "^0.72.67",
-    "@stacksjs/ui": "^0.72.67",
-    "@stacksjs/utils": "^0.72.67",
-    "@stacksjs/validation": "^0.72.67",
+    "@stacksjs/scheduler": "^0.72.69",
+    "@stacksjs/search-engine": "^0.72.69",
+    "@stacksjs/security": "^0.72.69",
+    "@stacksjs/server": "^0.72.69",
+    "@stacksjs/sites": "^0.72.69",
+    "@stacksjs/skills": "^0.72.69",
+    "@stacksjs/storage": "^0.72.69",
+    "@stacksjs/strings": "^0.72.69",
+    "@stacksjs/testing": "^0.72.69",
+    "@stacksjs/tinker": "^0.72.69",
+    "@stacksjs/ts-cloud": "^0.12.3",
+    "@stacksjs/tunnel": "^0.72.69",
+    "@stacksjs/types": "^0.72.69",
+    "@stacksjs/ui": "^0.72.69",
+    "@stacksjs/utils": "^0.72.69",
+    "@stacksjs/validation": "^0.72.69",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "ts-pantry": "^0.11.35"