@yadurajfleetos/cli 0.4.1 → 0.6.0

package/dist/commands/index.js

@@ -10,7 +10,7 @@ import { downCommand } from './down.js';
 import { unpairCommand, agentCommand } from './unpair.js';
 import { secretsCommand } from './secrets.js';
 import { backupCommand, backupsCommand, restoreCommand } from './backups.js';
-import { applyCommand, deployCommand, deploymentsCommand, initCommand, logsCommand, removeServiceCommand, restartCommand, rollbackCommand, rescheduleCommand, servicesCommand, validateCommand, whereCommand, } from './services.js';
+import { applyCommand, deployCommand, deploymentsCommand, initCommand, importCommand, logsCommand, removeServiceCommand, restartCommand, rollbackCommand, rescheduleCommand, servicesCommand, validateCommand, whereCommand, } from './services.js';
 export const commands = {
     up: upCommand,
     open: openCommand,
@@ -21,6 +21,7 @@ export const commands = {
     use: useCommand,
     doctor: doctorCommand,
     init: initCommand,
+    import: importCommand,
     validate: validateCommand,
     apply: applyCommand,
     status: statusCommand,

package/dist/commands/services.js

@@ -403,6 +403,31 @@ export const initCommand = {
         const name = (typeof flags.name === 'string' ? flags.name : '') ||
             process.cwd().split('/').pop()?.toLowerCase().replace(/[^a-z0-9-]+/g, '-') ||
             'app';
+        // Read the whole repository first. A monorepo, an apps/ directory, or a
+        // service beside a database is the ordinary case, and describing only the
+        // current directory left every one of those to be written out by hand.
+        const { discover, manifestFromDiscovery } = await import('../discover.js');
+        const found = await discover();
+        if (found.services.length > 1 || found.databases.length) {
+            const { manifest, questions } = manifestFromDiscovery(found, {
+                fleet: typeof flags.fleet === 'string' ? flags.fleet : undefined,
+                node: typeof flags.node === 'string' ? flags.node : undefined,
+            });
+            await writeFile(path, manifest);
+            console.log(`${c.green('created')} ${path}`);
+            if (found.layout)
+                console.log(c.dim(`  ${found.layout}`));
+            for (const s of found.services) {
+                console.log(c.dim(`  · ${s.name}  ${s.dir}  ${s.detection.label}`));
+            }
+            for (const db of found.databases) {
+                console.log(c.dim(`  · ${db.name} (${db.engine}) — ${db.because}`));
+            }
+            for (const q of questions)
+                console.log(`  ${c.yellow('?')} ${q}`);
+            console.log(c.dim(`\n  check it with: fleet apply --dry-run`));
+            return;
+        }
         const d = await detect();
         // Write a Dockerfile if we generated one and none exists.
         if (d.dockerfile) {
@@ -473,3 +498,66 @@ export const removeServiceCommand = {
             console.log(c.dim(`  ${body.note}`));
     },
 };
+/**
+ * docker-compose.yml → fleet.yaml.
+ *
+ * The most common way to arrive at Fleet with several services, two languages
+ * and a database is to already have a compose file describing exactly that.
+ * Reading it is a transform rather than a guess, so this needs no network, no
+ * account, and no model — it works before you have signed in.
+ *
+ * It prints what it decided and what it could not answer. A converter that
+ * silently drops a bind mount or invents a node is worse than one that refuses,
+ * because the reader only finds out at deploy time.
+ */
+export const importCommand = {
+    async run(args, flags) {
+        const { composeToFleet } = await import('../compose.js');
+        const source = args[0] ?? 'docker-compose.yml';
+        let text;
+        try {
+            text = await readFile(source, 'utf8');
+        }
+        catch {
+            throw new CliError(`could not read ${source}\n  pass a path: fleet import path/to/docker-compose.yml`, EXIT.usage);
+        }
+        const out = manifestPath(typeof flags.out === 'string' ? flags.out : undefined);
+        const force = flags.force === true;
+        if (!force) {
+            try {
+                await access(out);
+                throw new CliError(`${out} already exists — pass --force to overwrite it.`, EXIT.usage);
+            }
+            catch (err) {
+                if (err instanceof CliError)
+                    throw err;
+            }
+        }
+        let result;
+        try {
+            result = composeToFleet(text, {
+                fleet: typeof flags.fleet === 'string' ? flags.fleet : undefined,
+                node: typeof flags.node === 'string' ? flags.node : undefined,
+            });
+        }
+        catch (err) {
+            throw new CliError(err.message, EXIT.usage);
+        }
+        // --dry-run prints and writes nothing, so the output can be piped or read
+        // before it lands next to the file it was derived from.
+        if (flags['dry-run'] === true) {
+            process.stdout.write(result.manifest);
+        }
+        else {
+            await writeFile(out, result.manifest);
+            console.log(`${c.green('created')} ${out}  ${c.dim(`from ${source}`)}`);
+        }
+        for (const note of result.notes)
+            console.log(`  ${c.dim('·')} ${c.dim(note)}`);
+        for (const q of result.questions)
+            console.log(`  ${c.yellow('?')} ${q}`);
+        if (!result.questions.length) {
+            console.log(c.dim(`\n  check it with: fleet apply --dry-run`));
+        }
+    },
+};

package/dist/compose.js

@@ -0,0 +1,338 @@
+import { parse as parseYaml } from 'yaml';
+import { safeDatabaseName } from './dbnames.js';
+/** Images Fleet manages as databases rather than as plain containers. */
+const ENGINE_IMAGES = {
+    postgres: 'postgres',
+    postgis: 'postgres',
+    'timescale/timescaledb': 'postgres',
+    mysql: 'mysql',
+    mariadb: 'mariadb',
+    redis: 'redis',
+    valkey: 'redis',
+    mongo: 'mongo',
+    mongodb: 'mongo',
+};
+/**
+ * Names that mean "this value is a credential".
+ *
+ * Compose has no notion of a secret, so a password sits in the file as plain
+ * text. Copying it into `env` would move a credential into a manifest people
+ * commit; these keys become `secrets`, which Fleet injects at deploy time.
+ */
+const SECRET_HINT = /(PASSWORD|PASSWD|SECRET|TOKEN|APIKEY|API_KEY|ACCESS_KEY|PRIVATE|CREDENTIAL|_DSN|_URI|_URL_AUTH|SALT|CERT)/i;
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const asRecord = (v) => v && typeof v === 'object' && !Array.isArray(v) ? v : null;
+/** compose accepts both `KEY=value` lists and `{KEY: value}` maps. */
+function readEnv(raw) {
+    const out = {};
+    if (Array.isArray(raw)) {
+        for (const entry of raw) {
+            if (typeof entry !== 'string')
+                continue;
+            const eq = entry.indexOf('=');
+            if (eq < 0)
+                out[entry] = '';
+            else
+                out[entry.slice(0, eq)] = entry.slice(eq + 1);
+        }
+    }
+    else {
+        const map = asRecord(raw);
+        if (map)
+            for (const [k, v] of Object.entries(map))
+                out[k] = v == null ? '' : String(v);
+    }
+    return out;
+}
+/**
+ * "127.0.0.1:8080:80/tcp" → { host: 8080, container: 80 }.
+ *
+ * Counted from the end because the optional bind address is on the front, so
+ * the last two numbers are always the pair that matters.
+ */
+function readPorts(raw) {
+    if (!Array.isArray(raw))
+        return null;
+    for (const entry of raw) {
+        if (typeof entry === 'number')
+            return { host: entry, container: entry };
+        if (typeof entry !== 'string') {
+            const obj = asRecord(entry);
+            if (obj && typeof obj.target === 'number') {
+                return { host: Number(obj.published ?? obj.target), container: obj.target };
+            }
+            continue;
+        }
+        const parts = entry.split('/')[0].split(':').filter(Boolean);
+        const nums = parts.map(Number).filter((n) => Number.isFinite(n));
+        if (!nums.length)
+            continue;
+        if (nums.length === 1)
+            return { host: nums[0], container: nums[0] };
+        return { host: nums[nums.length - 2], container: nums[nums.length - 1] };
+    }
+    return null;
+}
+/**
+ * The first named volume, plus every mount that was left behind.
+ *
+ * Both halves are returned because dropping something quietly is the whole
+ * problem: a bind mount that disappears is a directory the service expected
+ * and will not find, and reporting it only when nothing else matched meant the
+ * common case - one real volume beside one bind mount - said nothing at all.
+ */
+function readVolumes(raw) {
+    const skipped = [];
+    let volume = null;
+    if (!Array.isArray(raw))
+        return { volume, skipped };
+    for (const entry of raw) {
+        if (typeof entry !== 'string') {
+            const obj = asRecord(entry);
+            if (obj?.type === 'volume' && typeof obj.source === 'string' && typeof obj.target === 'string') {
+                if (!volume)
+                    volume = { name: obj.source, path: obj.target };
+                else
+                    skipped.push(`${obj.source}:${obj.target}`);
+            }
+            else if (obj?.type === 'bind') {
+                skipped.push(String(obj.source ?? 'bind mount'));
+            }
+            continue;
+        }
+        const [source, target] = entry.split(':');
+        if (!source || !target)
+            continue;
+        // A path is a bind mount of the developer's own machine, and means nothing
+        // on a node that has never seen that directory.
+        if (source.startsWith('.') || source.startsWith('/') || source.startsWith('~')) {
+            skipped.push(entry);
+            continue;
+        }
+        if (!volume)
+            volume = { name: source, path: target };
+        else
+            skipped.push(entry);
+    }
+    return { volume, skipped };
+}
+/** compose memory limits are "512m", "2g", or a byte count. */
+function readMemory(raw) {
+    if (raw == null)
+        return null;
+    const s = String(raw).trim().toLowerCase();
+    const m = s.match(/^(\d+(?:\.\d+)?)\s*([kmg])?b?$/);
+    if (!m)
+        return null;
+    const n = Number(m[1]);
+    switch (m[2]) {
+        case 'g': return `${Math.round(n * 1024)}Mi`;
+        case 'm': return `${Math.round(n)}Mi`;
+        case 'k': return `${Math.max(1, Math.round(n / 1024))}Mi`;
+        default: return `${Math.max(1, Math.round(n / (1024 * 1024)))}Mi`;
+    }
+}
+/** A health path out of a compose healthcheck, when one is discoverable. */
+function readHealthPath(raw) {
+    const hc = asRecord(raw);
+    if (!hc)
+        return null;
+    const test = hc.test;
+    const line = Array.isArray(test) ? test.join(' ') : typeof test === 'string' ? test : '';
+    const url = line.match(/https?:\/\/[^\s"']+/);
+    if (url) {
+        try {
+            return new URL(url[0]).pathname || '/';
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+const engineFor = (image) => {
+    const name = image.split('@')[0].split(':')[0].toLowerCase();
+    const bare = name.replace(/^(docker\.io|library)\//, '');
+    return ENGINE_IMAGES[bare] ?? ENGINE_IMAGES[bare.split('/').pop() ?? ''] ?? null;
+};
+const versionOf = (image) => {
+    const tag = image.split('@')[0].split(':')[1];
+    if (!tag || tag === 'latest')
+        return null;
+    const major = tag.match(/^(\d+)/);
+    return major ? major[1] : null;
+};
+/** YAML-safe scalar. Quoted unless it is unambiguously a bare word. */
+const scalar = (v) => /^[A-Za-z0-9._/-]+$/.test(v) && v !== '' ? v : JSON.stringify(v);
+export function composeToFleet(source, opts = {}) {
+    const notes = [];
+    const questions = [];
+    let doc;
+    try {
+        doc = parseYaml(source);
+    }
+    catch (err) {
+        throw new Error(`that file is not valid YAML: ${err.message}`);
+    }
+    const root = asRecord(doc);
+    const servicesRaw = asRecord(root?.services);
+    if (!servicesRaw || !Object.keys(servicesRaw).length) {
+        throw new Error('no services found — is this a docker-compose file?');
+    }
+    const fleetName = opts.fleet ?? 'homelab';
+    const dbNode = opts.node ?? null;
+    const services = [];
+    const databases = [];
+    /** Compose names that became databases, so `depends_on` can point at them. */
+    const asDatabase = new Set();
+    /** Compose name -> the name the database is declared under, which differs
+        whenever the compose name would collide with its engine's own env vars. */
+    const dbNames = new Map();
+    const takenDbNames = new Set();
+    // Databases first, so a service's `uses` can reference one by name.
+    for (const [name, raw] of Object.entries(servicesRaw)) {
+        const svc = (asRecord(raw) ?? {});
+        const image = typeof svc.image === 'string' ? svc.image : '';
+        const engine = image ? engineFor(image) : null;
+        if (!engine)
+            continue;
+        asDatabase.add(name);
+        // Named here, in the pre-pass, not where the database is rendered: a
+        // service declared before it in the file still has to point at the name it
+        // ends up with, and the main loop would not know it yet.
+        dbNames.set(name, safeDatabaseName(name, engine, takenDbNames));
+    }
+    for (const [name, raw] of Object.entries(servicesRaw)) {
+        const svc = (asRecord(raw) ?? {});
+        const image = typeof svc.image === 'string' ? svc.image : '';
+        const env = readEnv(svc.environment);
+        if (asDatabase.has(name)) {
+            const engine = engineFor(image);
+            const major = versionOf(image);
+            const declared = dbNames.get(name);
+            if (declared !== name) {
+                notes.push(`${name} is declared as "${declared}": a database named after its own engine derives a password secret that collides with the engine's own environment variable, and the manifest is rejected.`);
+            }
+            const lines = [`  ${declared}:`];
+            lines.push(`    engine: ${major ? `${engine}@${major}` : engine}`);
+            if (dbNode)
+                lines.push(`    node: ${scalar(dbNode)}`);
+            else {
+                lines.push(`    node: CHANGE_ME`);
+                questions.push(`${name}: a database must name the node that holds its data. Replace CHANGE_ME with a node name, or re-run with --node.`);
+            }
+            // Compose states these as env; Fleet takes them as fields and manages
+            // the credential itself, so they are lifted rather than copied.
+            const dbName = env.POSTGRES_DB ?? env.MYSQL_DATABASE ?? env.MARIADB_DATABASE ?? env.MONGO_INITDB_DATABASE;
+            const dbUser = env.POSTGRES_USER ?? env.MYSQL_USER ?? env.MARIADB_USER ?? env.MONGO_INITDB_ROOT_USERNAME;
+            if (dbName)
+                lines.push(`    database: ${scalar(dbName)}`);
+            if (dbUser)
+                lines.push(`    user: ${scalar(dbUser)}`);
+            lines.push(`    backup: daily`);
+            databases.push(lines.join('\n'));
+            notes.push(`${name} became a managed ${engine} database — Fleet owns its volume, credentials and backups, so the password from your compose file is not carried over.`);
+            continue;
+        }
+        const lines = [`  ${name}:`];
+        // build or image, never both: the schema rejects it, and they mean
+        // different things.
+        if (svc.build != null && !image) {
+            const b = asRecord(svc.build);
+            const context = typeof svc.build === 'string' ? svc.build : typeof b?.context === 'string' ? b.context : '.';
+            lines.push(`    build: ${scalar(context)}`);
+        }
+        else if (image) {
+            lines.push(`    image: ${scalar(image)}`);
+            if (svc.build != null) {
+                notes.push(`${name}: compose set both build and image; kept image, because that is what compose would have run.`);
+            }
+        }
+        else {
+            lines.push(`    build: .`);
+            questions.push(`${name}: compose named neither an image nor a build context — check the build path.`);
+        }
+        lines.push('    placement: flexible');
+        const ports = readPorts(svc.ports) ?? readPorts(svc.expose);
+        if (ports) {
+            lines.push(`    port: ${ports.host}`);
+            if (ports.container !== ports.host)
+                lines.push(`    container_port: ${ports.container}`);
+        }
+        const mem = readMemory(asRecord(asRecord(asRecord(svc.deploy)?.resources)?.limits)?.memory ?? svc.mem_limit);
+        const cpus = asRecord(asRecord(asRecord(svc.deploy)?.resources)?.limits)?.cpus ?? svc.cpus;
+        const ram = mem ?? '512Mi';
+        const cpu = cpus != null && Number.isFinite(Number(cpus)) ? Number(cpus) : 0.5;
+        lines.push(`    resources: { ram: ${ram}, cpu: ${cpu} }`);
+        if (!mem)
+            notes.push(`${name}: compose set no memory limit, so 512Mi was assumed — the scheduler needs a number to place against.`);
+        const health = readHealthPath(svc.healthcheck);
+        lines.push(`    health: { path: ${health ?? '/'} }`);
+        if (svc.healthcheck && !health) {
+            notes.push(`${name}: its healthcheck is a command Fleet cannot reuse, so health falls back to "/" — set a real path if that is wrong.`);
+        }
+        const { volume: vol, skipped } = readVolumes(svc.volumes);
+        if (vol)
+            lines.push(`    volume: { name: ${scalar(vol.name)}, path: ${scalar(vol.path)} }`);
+        if (skipped.length) {
+            notes.push(`${name}: dropped ${skipped.join(', ')} — a service carries one named volume, and a bind mount of your own machine means nothing on a node.`);
+        }
+        // env vs secrets. A value compose leaves to interpolation is not in the
+        // file at all, so it cannot be copied - it becomes a secret to supply.
+        const plain = [];
+        const secrets = [];
+        for (const [k, v] of Object.entries(env)) {
+            if (!ENV_NAME.test(k)) {
+                notes.push(`${name}: dropped env key "${k}" — not a usable variable name.`);
+                continue;
+            }
+            const unresolved = v === '' || /^\$\{?[A-Za-z_]/.test(v);
+            if (SECRET_HINT.test(k) || unresolved)
+                secrets.push(k);
+            else
+                plain.push([k, v]);
+        }
+        if (plain.length) {
+            lines.push('    env:');
+            for (const [k, v] of plain)
+                lines.push(`      ${k}: ${scalar(v)}`);
+        }
+        if (secrets.length) {
+            lines.push(`    secrets: [${secrets.join(', ')}]`);
+            notes.push(`${name}: ${secrets.join(', ')} moved to secrets — set them with \`fleet secret set\`, so no credential lives in this file.`);
+        }
+        // `uses` names databases, not services — the parser rejects anything else
+        // with "is not a database in this manifest". compose's depends_on covers
+        // both, so it has to be split: the database half becomes `uses`, and the
+        // service half is dropped, because Fleet works out deploy order itself
+        // rather than taking it from the file.
+        const deps = Array.isArray(svc.depends_on)
+            ? svc.depends_on.filter((d) => typeof d === 'string')
+            : Object.keys(asRecord(svc.depends_on) ?? {});
+        const dbDeps = deps.filter((d) => asDatabase.has(d)).map((d) => dbNames.get(d) ?? d);
+        const svcDeps = deps.filter((d) => !asDatabase.has(d));
+        if (dbDeps.length)
+            lines.push(`    uses: [${dbDeps.join(', ')}]`);
+        if (svcDeps.length) {
+            notes.push(`${name}: depends_on ${svcDeps.join(', ')} was dropped — "uses" declares databases, and Fleet decides deploy order from the manifest rather than being told.`);
+        }
+        const replicas = asRecord(svc.deploy)?.replicas;
+        if (typeof replicas === 'number' && replicas > 1)
+            lines.push(`    replicas: ${replicas}`);
+        services.push(lines.join('\n'));
+    }
+    // A manifest requires at least one service - "a manifest with no services
+    // has nothing to deploy" is the product's rule, not an accident. A compose
+    // file that is only databases would otherwise emit an empty `services:` key,
+    // which YAML reads as null and the parser rejects with a message about
+    // records that explains nothing about what the reader actually did.
+    if (!services.length) {
+        const only = [...asDatabase].join(', ');
+        throw new Error(`every service in that file is a database (${only}), and a manifest needs something to deploy. ` +
+            `Fleet manages those engines for you — declare them alongside the application that uses them.`);
+    }
+    const out = [`fleet: ${scalar(fleetName)}`, '', 'services:', services.join('\n\n')];
+    if (databases.length)
+        out.push('', 'databases:', databases.join('\n\n'));
+    return { manifest: out.join('\n') + '\n', notes, questions };
+}

package/dist/dbnames.js

@@ -0,0 +1,34 @@
+/**
+ * What to call a managed database, when the obvious name breaks.
+ *
+ * The manifest derives a database's password secret from its name:
+ * `passwordRefFor("main")` is MAIN_PASSWORD. That is a good rule, and it has
+ * one collision. A database called `postgres` derives POSTGRES_PASSWORD, which
+ * is also the environment variable the Postgres image itself expects — so the
+ * generated service ends up with the same key in both `env` and `secrets`, and
+ * the parser rejects the whole manifest.
+ *
+ * It matters because `postgres:` is one of the most common service names in a
+ * docker-compose file, so the most ordinary input produced something the
+ * product refused. Renaming to `db` is also simply what a person writing this
+ * by hand would have done: `uses: [db, cache]` reads better than
+ * `uses: [postgres, redis]`.
+ */
+/** What a person would call each engine, rather than what the image is called. */
+const FRIENDLY = {
+    postgres: 'db',
+    mysql: 'db',
+    mariadb: 'db',
+    mongo: 'db',
+    redis: 'cache',
+};
+export function safeDatabaseName(preferred, engine, taken) {
+    const base = preferred.toLowerCase() === engine.toLowerCase() ? (FRIENDLY[engine] ?? 'db') : preferred;
+    // Two Postgres databases in one file both want to be `db`.
+    let name = base;
+    let n = 2;
+    while (taken.has(name))
+        name = `${base}${n++}`;
+    taken.add(name);
+    return name;
+}

package/dist/discover.js

@@ -0,0 +1,349 @@
+import { readdir, readFile, access } from 'node:fs/promises';
+import { basename, join, relative } from 'node:path';
+import { detect } from './detect.js';
+import { safeDatabaseName } from './dbnames.js';
+const exists = async (p) => {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const readText = async (p) => {
+    try {
+        return await readFile(p, 'utf8');
+    }
+    catch {
+        return '';
+    }
+};
+const readJson = async (p) => {
+    try {
+        return JSON.parse(await readFile(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+};
+/** Directories that are never a service, whatever else they contain. */
+const IGNORED = new Set([
+    'node_modules', '.git', 'dist', 'build', 'target', 'vendor', '.next',
+    'coverage', '__pycache__', '.venv', 'venv', 'tmp', '.turbo', '.cache',
+]);
+/**
+ * Dependencies that mean "this service talks to a database".
+ *
+ * A driver in the dependency list is evidence, not a guess: nobody installs
+ * `pg` for a service that does not speak to Postgres.
+ */
+const DB_HINTS = [
+    {
+        engine: 'postgres',
+        deps: [
+            'pg', 'postgres', 'pg-promise', 'postgres.js', '@prisma/client', 'prisma',
+            'typeorm', 'sequelize', 'drizzle-orm', 'knex', 'psycopg2', 'psycopg2-binary',
+            'psycopg', 'asyncpg', 'sqlalchemy', 'django', 'lib/pq', 'jackc/pgx', 'sqlx',
+            'tokio-postgres', 'diesel',
+        ],
+    },
+    { engine: 'redis', deps: ['redis', 'ioredis', 'redis-py', 'go-redis', 'bull', 'bullmq', 'celery'] },
+    { engine: 'mysql', deps: ['mysql', 'mysql2', 'mysqlclient', 'pymysql', 'go-sql-driver'] },
+    { engine: 'mongo', deps: ['mongodb', 'mongoose', 'pymongo', 'motor', 'mongo-driver'] },
+];
+/** Dependencies that mean "this wants a GPU and a lot more memory". */
+const GPU_HINTS = [
+    'torch', 'pytorch', 'tensorflow', 'transformers', 'vllm', 'accelerate',
+    'onnxruntime-gpu', 'jax', 'diffusers', 'sentence-transformers', 'llama-cpp-python',
+];
+const SECRET_HINT = /(PASSWORD|SECRET|TOKEN|APIKEY|API_KEY|ACCESS_KEY|PRIVATE|CREDENTIAL|_DSN|SALT|CERT|_URL$)/i;
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Every dependency name a directory declares, across ecosystems. */
+async function dependenciesOf(dir) {
+    const out = [];
+    const pkg = await readJson(join(dir, 'package.json'));
+    if (pkg) {
+        for (const field of ['dependencies', 'devDependencies', 'peerDependencies']) {
+            const deps = pkg[field];
+            if (deps && typeof deps === 'object')
+                out.push(...Object.keys(deps));
+        }
+    }
+    // Python: one name per line, before any version specifier.
+    for (const file of ['requirements.txt', 'requirements-prod.txt', 'pyproject.toml', 'Pipfile']) {
+        const text = await readText(join(dir, file));
+        for (const line of text.split('\n')) {
+            const name = line.trim().split(/[=<>!~\[;#"']/)[0]?.trim();
+            if (name && /^[A-Za-z][A-Za-z0-9._-]*$/.test(name))
+                out.push(name.toLowerCase());
+        }
+    }
+    // Go and Rust name their dependencies as paths and table keys respectively;
+    // a substring match on the whole file is enough to spot a driver.
+    for (const file of ['go.mod', 'go.sum', 'Cargo.toml']) {
+        const text = await readText(join(dir, file));
+        if (text)
+            out.push(...text.split('\n').map((l) => l.trim().toLowerCase()));
+    }
+    return out;
+}
+const mentions = (deps, needle) => deps.some((d) => d === needle || d.includes(needle));
+/** Variable names a service declares it needs. */
+async function envFrom(dir) {
+    const env = [];
+    const secrets = [];
+    for (const file of ['.env.example', '.env.sample', '.env.template']) {
+        const text = await readText(join(dir, file));
+        for (const line of text.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith('#'))
+                continue;
+            const key = trimmed.split('=')[0]?.trim();
+            if (!key || !ENV_NAME.test(key))
+                continue;
+            // A credential and a setting are different things: one belongs in the
+            // manifest, the other must never appear in a file anyone commits.
+            if (SECRET_HINT.test(key))
+                secrets.push(key);
+            else
+                env.push(key);
+        }
+    }
+    return { env: [...new Set(env)], secrets: [...new Set(secrets)] };
+}
+/** Workspace globs, from whichever convention this repository uses. */
+async function workspaceGlobs(root) {
+    const pkg = await readJson(join(root, 'package.json'));
+    const ws = pkg?.workspaces;
+    if (Array.isArray(ws))
+        return { layout: 'npm workspaces', globs: ws.filter((w) => typeof w === 'string') };
+    if (ws && typeof ws === 'object' && Array.isArray(ws.packages)) {
+        return { layout: 'yarn workspaces', globs: ws.packages };
+    }
+    const pnpm = await readText(join(root, 'pnpm-workspace.yaml'));
+    if (pnpm) {
+        const globs = pnpm
+            .split('\n')
+            .map((l) => l.trim())
+            .filter((l) => l.startsWith('- '))
+            .map((l) => l.slice(2).replace(/['"]/g, '').trim())
+            .filter(Boolean);
+        if (globs.length)
+            return { layout: 'pnpm workspace', globs };
+    }
+    const lerna = await readJson(join(root, 'lerna.json'));
+    if (Array.isArray(lerna?.packages))
+        return { layout: 'lerna', globs: lerna.packages };
+    const goWork = await readText(join(root, 'go.work'));
+    if (goWork) {
+        const globs = [...goWork.matchAll(/^\s*\.?\/?([\w./-]+)\s*$/gm)]
+            .map((m) => m[1])
+            .filter((p) => p !== 'go' && !p.includes('use') && p !== '.');
+        if (globs.length)
+            return { layout: 'go workspace', globs };
+    }
+    const cargo = await readText(join(root, 'Cargo.toml'));
+    const members = cargo.match(/members\s*=\s*\[([^\]]*)\]/);
+    if (members) {
+        const globs = [...members[1].matchAll(/["']([^"']+)["']/g)].map((m) => m[1]);
+        if (globs.length)
+            return { layout: 'cargo workspace', globs };
+    }
+    return null;
+}
+/**
+ * Expand the one glob shape workspaces actually use: a directory then `/*`.
+ *
+ * Deliberately not a glob library. `apps/*` and `packages/*` are what these
+ * files contain in practice, and a dependency to handle the rest is not worth
+ * carrying in a CLI whose whole install is one package.
+ */
+async function expand(root, globs) {
+    const dirs = new Set();
+    for (const glob of globs) {
+        if (!glob.includes('*')) {
+            if (await exists(join(root, glob)))
+                dirs.add(glob);
+            continue;
+        }
+        const base = glob.slice(0, glob.indexOf('*')).replace(/\/$/, '');
+        try {
+            for (const entry of await readdir(join(root, base), { withFileTypes: true })) {
+                if (entry.isDirectory() && !IGNORED.has(entry.name))
+                    dirs.add(join(base, entry.name));
+            }
+        }
+        catch {
+            /* a workspace glob pointing at nothing is the repository's problem */
+        }
+    }
+    return [...dirs];
+}
+/** Conventional layouts, for repositories that declare no workspaces. */
+async function conventionalDirs(root) {
+    const dirs = [];
+    for (const parent of ['apps', 'services', 'packages']) {
+        try {
+            for (const entry of await readdir(join(root, parent), { withFileTypes: true })) {
+                if (entry.isDirectory() && !IGNORED.has(entry.name))
+                    dirs.push(join(parent, entry.name));
+            }
+        }
+        catch {
+            /* not this layout */
+        }
+    }
+    return dirs;
+}
+/**
+ * Whether a directory is something to deploy.
+ *
+ * A monorepo is mostly libraries, and a manifest that tries to deploy a shared
+ * types package is noise the reader has to delete. Something to run says so:
+ * it has a Dockerfile, a start script, or a recognised framework.
+ */
+async function isDeployable(dir, d) {
+    if (d.hasDockerfile)
+        return true;
+    if (d.framework !== 'unknown') {
+        const pkg = await readJson(join(dir, 'package.json'));
+        if (pkg) {
+            const scripts = (pkg.scripts ?? {});
+            // A package with no way to start is a library, whatever it depends on.
+            if (!scripts.start && !scripts.dev && !scripts.serve && d.framework !== 'vite')
+                return false;
+        }
+        return true;
+    }
+    return false;
+}
+const serviceName = (dir, root) => {
+    const raw = dir === '.' ? basename(root) : basename(dir);
+    return raw.toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '') || 'app';
+};
+export async function discover(root = process.cwd()) {
+    const notes = [];
+    const ws = await workspaceGlobs(root);
+    let candidates = [];
+    let layout = null;
+    if (ws) {
+        layout = ws.layout;
+        candidates = await expand(root, ws.globs);
+        notes.push(`${ws.layout} declares ${candidates.length} package${candidates.length === 1 ? '' : 's'}`);
+    }
+    else {
+        const conventional = await conventionalDirs(root);
+        if (conventional.length) {
+            layout = 'apps/ and services/ directories';
+            candidates = conventional;
+            notes.push(`no workspace file, but ${conventional.length} directories look like services`);
+        }
+    }
+    // Always consider the root itself: a repository can be a monorepo and still
+    // deploy something from its top level.
+    if (!candidates.includes('.'))
+        candidates.unshift('.');
+    const services = [];
+    const allDeps = new Set();
+    for (const dir of candidates) {
+        const abs = dir === '.' ? root : join(root, dir);
+        const d = await detect(abs);
+        const deps = await dependenciesOf(abs);
+        deps.forEach((x) => allDeps.add(x));
+        // Which engines THIS package depends on. Taking the union across the
+        // repository made a Next.js frontend declare it uses the database, which
+        // is a claim the manifest should not be making on its behalf.
+        const ownEngines = DB_HINTS.filter(({ deps: hints }) => hints.some((h) => mentions(deps, h))).map((x) => x.engine);
+        if (!(await isDeployable(abs, d)))
+            continue;
+        // A root that only exists to hold workspaces is not a service; without
+        // this a monorepo gains a phantom service named after the repository.
+        if (dir === '.' && ws && !d.hasDockerfile)
+            continue;
+        const { env, secrets } = await envFrom(abs);
+        const gpu = GPU_HINTS.find((h) => mentions(deps, h)) ?? null;
+        services.push({
+            name: serviceName(dir, root),
+            dir: dir === '.' ? '.' : `./${relative(root, abs)}`,
+            detection: d,
+            env,
+            secrets,
+            gpu: gpu ? `depends on ${gpu}` : null,
+            engines: ownEngines,
+            // A model needs room; everything else gets a modest default the reader
+            // can lower once they know what it actually uses.
+            ramMb: gpu ? 4096 : 512,
+        });
+    }
+    const deps = [...allDeps];
+    const databases = [];
+    const takenDbNames = new Set();
+    for (const { engine, deps: hints } of DB_HINTS) {
+        const hit = hints.find((h) => mentions(deps, h));
+        // Named `db` and `cache` rather than `postgres` and `redis`: a database
+        // named after its engine collides with that engine's own environment
+        // variables, and it is not what anyone would write by hand either.
+        if (hit) {
+            databases.push({
+                name: safeDatabaseName(engine, engine, takenDbNames),
+                engine,
+                because: `something depends on ${hit}`,
+            });
+        }
+    }
+    if (!services.length) {
+        notes.push('nothing deployable found — no Dockerfile, and no framework this recognises');
+    }
+    for (const db of databases)
+        notes.push(`${db.engine}: ${db.because}`);
+    return { root, layout, services, databases, notes };
+}
+/** Render a discovery as a manifest. */
+export function manifestFromDiscovery(d, opts = {}) {
+    const questions = [];
+    const fleet = opts.fleet ?? 'homelab';
+    const lines = [`fleet: ${fleet}`, '', 'services:'];
+    d.services.forEach((s, i) => {
+        if (i)
+            lines.push('');
+        lines.push(`  ${s.name}:`);
+        lines.push(`    build: ${s.dir}`);
+        lines.push('    placement: flexible');
+        if (s.detection.port !== 80)
+            lines.push(`    container_port: ${s.detection.port}`);
+        lines.push(`    resources: { ram: ${s.ramMb}Mi, cpu: 0.5 }`);
+        lines.push(`    health: { path: ${s.detection.healthPath} }`);
+        if (s.gpu) {
+            lines.push('    gpu: true');
+            questions.push(`${s.name}: ${s.gpu}, so it asks for a GPU — remove "gpu: true" if it runs on CPU.`);
+        }
+        if (s.env.length) {
+            lines.push('    env:');
+            for (const key of s.env)
+                lines.push(`      ${key}: ""   # from .env.example`);
+        }
+        if (s.secrets.length)
+            lines.push(`    secrets: [${s.secrets.join(', ')}]`);
+        const mine = d.databases.filter((db) => s.engines.includes(db.engine));
+        if (mine.length)
+            lines.push(`    uses: [${mine.map((db) => db.name).join(', ')}]`);
+    });
+    if (d.databases.length) {
+        lines.push('', 'databases:');
+        d.databases.forEach((db, i) => {
+            if (i)
+                lines.push('');
+            lines.push(`  ${db.name}:`);
+            lines.push(`    engine: ${db.engine}`);
+            if (opts.node)
+                lines.push(`    node: ${opts.node}`);
+            else {
+                lines.push('    node: CHANGE_ME');
+                questions.push(`${db.name}: a database must name the node that holds its data — replace CHANGE_ME, or re-run with --node.`);
+            }
+            lines.push('    backup: daily');
+        });
+    }
+    return { manifest: lines.join('\n') + '\n', questions };
+}

package/dist/index.js

@@ -16,7 +16,8 @@ const GROUPS = [
         'getting started',
         [
             ['up [service]', 'Deploy the whole fleet.yaml, in dependency order'],
-            ['init', 'Scaffold a fleet.yaml and Dockerfile from this repository'],
+            ['init', 'Read the repository — monorepo, databases, secrets — and write a fleet.yaml'],
+            ['import [file]', 'Convert a docker-compose.yml into a fleet.yaml'],
             ['config show', 'Show the saved control plane and selected fleet'],
             ['use <fleet>', 'Select the default fleet for later commands'],
             ['auth login', 'Sign in and save a secure local session'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadurajfleetos/cli",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Fleet OS command-line interface for deploying and orchestrating services on user-owned hardware",
   "type": "module",
   "license": "MIT",