deploro 0.3.3 → 0.4.0

package/dist/index.js

@@ -493,6 +493,129 @@ async function tokenRevokeCommand(id, opts) {
   await apiRequestNoProject(`/api/auth/tokens/${encodeURIComponent(id)}`, { method: "DELETE" });
   console.log(`\u2713 Token ${id} revoked`);
 }
+function isEmailProvider(provider) {
+  return provider === "email" || provider === "email_password";
+}
+async function authProvidersListCommand() {
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/auth/providers`
+  );
+  const known = [
+    "email",
+    "email_password",
+    "google",
+    "github",
+    "facebook",
+    "twitter",
+    "discord",
+    "microsoft",
+    "linkedin",
+    "slack",
+    "gitlab",
+    "twitch",
+    "spotify",
+    "reddit",
+    "dropbox",
+    "notion",
+    "apple",
+    "upwork"
+  ];
+  const byProvider = new Map(data.providers.map((p) => [p.provider, p]));
+  const rows = known.map((provider) => {
+    const row = byProvider.get(provider);
+    const enabled = row?.enabled ?? false;
+    const configured = isEmailProvider(provider) || !!(row?.client_id && row?.client_secret);
+    return {
+      provider,
+      status: enabled && configured ? "active" : enabled ? "setup required" : "disabled"
+    };
+  });
+  table(rows);
+}
+async function authProviderEnableCommand(provider, enabled) {
+  const config = requireProject();
+  await apiRequest(
+    `/api/projects/${config.projectId}/auth/providers/${encodeURIComponent(provider)}`,
+    { method: "PUT", body: JSON.stringify({ enabled }) }
+  );
+  console.log(`\u2713 ${provider} ${enabled ? "enabled" : "disabled"}`);
+}
+async function authProviderConfigureCommand(provider, opts) {
+  const config = requireProject();
+  if (isEmailProvider(provider)) {
+    console.error(
+      `'${provider}' doesn't take OAuth credentials \u2014 it just needs enabling.
+Run: deploro auth providers enable ${provider}`
+    );
+    process.exit(1);
+  }
+  if (!opts.clientId || !opts.clientSecret) {
+    console.error("Both --client-id and --client-secret are required.");
+    process.exit(1);
+  }
+  if (provider === "apple" && (!opts.teamId || !opts.keyId)) {
+    console.error("Apple also requires --team-id and --key-id (--client-secret is the .p8 private key contents).");
+    process.exit(1);
+  }
+  await apiRequest(
+    `/api/projects/${config.projectId}/auth/providers/${encodeURIComponent(provider)}`,
+    {
+      method: "PUT",
+      body: JSON.stringify({
+        client_id: opts.clientId,
+        client_secret: opts.clientSecret,
+        ...provider === "apple" ? { extra_config: { team_id: opts.teamId, key_id: opts.keyId } } : {}
+      })
+    }
+  );
+  console.log(`\u2713 ${provider} credentials saved (still needs enabling \u2014 run: deploro auth providers enable ${provider})`);
+}
+async function authEndUsersListCommand(opts) {
+  const config = requireProject();
+  const page = Math.max(1, Number(opts.page ?? 1) || 1);
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/auth/users?page=${page}`
+  );
+  table(
+    data.users.map((u) => ({
+      id: u.id,
+      email: u.email ?? "",
+      name: u.name ?? "",
+      methods: u.providers.join(", "),
+      verified: u.email_verified,
+      lastLogin: u.last_login_at ? u.last_login_at.slice(0, 10) : "never"
+    }))
+  );
+  console.log(`
+${data.total} total end user(s), page ${data.page}`);
+}
+async function authEndUserAddCommand(email, opts) {
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/auth/users`,
+    { method: "POST", body: JSON.stringify({ email, name: opts.name }) }
+  );
+  console.log(`\u2713 Added ${data.user.email}`);
+  console.log("  A confirmation email was sent \u2014 they can't sign in until they click the link (one time, first use only).");
+}
+async function authEndUserDeleteCommand(id, opts) {
+  const config = requireProject();
+  await confirmOrDie(`Delete end user ${id}? This removes every sign-in method and session linked to them.`, opts.yes);
+  await apiRequest(`/api/projects/${config.projectId}/auth/users/${encodeURIComponent(id)}`, { method: "DELETE" });
+  console.log(`\u2713 End user ${id} deleted`);
+}
+async function authStatsCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/auth/stats`);
+  console.log(`Total end users   : ${data.total_users}`);
+  console.log(`Active sessions   : ${data.sessions_active}`);
+  console.log(`Providers enabled : ${data.providers_enabled}`);
+  if (data.users_by_provider.length > 0) {
+    console.log("\nBy sign-in method:");
+    table(data.users_by_provider.map((p) => ({ provider: p.provider, users: p.count })));
+  }
+}
 
 // src/commands/migrate.ts
 import { readFileSync as readFileSync2 } from "fs";
@@ -819,6 +942,211 @@ async function deployLogsCommand(deploymentId) {
   console.log("");
 }
 
+// src/commands/vps.ts
+async function vpsDatabaseCreateCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/database`, { method: "POST" });
+  if (data.already_provisioned) {
+    console.log("Already provisioned. The connection string is only ever shown once (on creation, or after a rotate).");
+    console.log(`  Host : ${data.host ?? "(unknown \u2014 VPS_PUBLIC_HOST not configured on the platform)"}`);
+    console.log(`  Port : ${data.port}`);
+    console.log(`  User : ${data.user}`);
+    console.log(`  DB   : ${data.database}`);
+    return;
+  }
+  console.log("\u2713 Raw Postgres provisioned:");
+  console.log(`  ${data.database_url}`);
+  console.log(`
+${data.note ?? ""}`);
+}
+async function vpsDatabaseInfoCommand() {
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/vps/database`
+  );
+  if (!data.provisioned) {
+    console.log("Not provisioned. Run: deploro vps database create");
+    return;
+  }
+  console.log("\n\u2500\u2500 RAW POSTGRES \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(`  Host : ${data.host ?? "(unknown \u2014 VPS_PUBLIC_HOST not configured on the platform)"}`);
+  console.log(`  Port : ${data.port}`);
+  console.log(`  User : ${data.user}`);
+  console.log(`  DB   : ${data.database}`);
+  console.log("  (password not stored in plaintext \u2014 run 'deploro vps database rotate' to issue a new one)\n");
+}
+async function vpsDatabaseRotateCommand(opts) {
+  const config = requireProject();
+  await confirmOrDie("Rotate the raw Postgres password? Anything using the old connection string will stop working until redeployed.", opts.yes);
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/vps/database/rotate`,
+    { method: "POST" }
+  );
+  console.log("\u2713 Password rotated:");
+  console.log(`  ${data.database_url}`);
+  console.log(`
+${data.note}`);
+}
+async function vpsRedisCreateCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/redis`, { method: "POST" });
+  if (data.already_provisioned) {
+    console.log("Already provisioned. The connection string is only ever shown once (on creation, or after a rotate).");
+    console.log(`  Host : ${data.host ?? "(unknown \u2014 VPS_PUBLIC_HOST not configured on the platform)"}`);
+    console.log(`  Port : ${data.port}`);
+    return;
+  }
+  console.log("\u2713 Raw Redis provisioned:");
+  console.log(`  ${data.redis_url}`);
+  console.log(`
+${data.note ?? ""}`);
+}
+async function vpsRedisInfoCommand() {
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/vps/redis`
+  );
+  if (!data.provisioned) {
+    console.log("Not provisioned. Run: deploro vps redis create");
+    return;
+  }
+  console.log("\n\u2500\u2500 RAW REDIS \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(`  Host : ${data.host ?? "(unknown \u2014 VPS_PUBLIC_HOST not configured on the platform)"}`);
+  console.log(`  Port : ${data.port}`);
+  console.log("  (password not stored in plaintext \u2014 run 'deploro vps redis rotate' to issue a new one)\n");
+}
+async function vpsRedisRotateCommand(opts) {
+  const config = requireProject();
+  await confirmOrDie("Rotate the raw Redis password? This briefly restarts the Redis container. Anything using the old connection string will stop working until redeployed.", opts.yes);
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/vps/redis/rotate`,
+    { method: "POST" }
+  );
+  console.log("\u2713 Password rotated:");
+  console.log(`  ${data.redis_url}`);
+  console.log(`
+${data.note}`);
+}
+async function vpsAllowlistListCommand() {
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/vps/allowlist`
+  );
+  if (data.entries.length === 0) {
+    console.log("No allowlist entries \u2014 raw Postgres/Redis ports accept no inbound connections until you add one.");
+    return;
+  }
+  table(data.entries.map((e) => ({ id: e.id, cidr: e.cidr, label: e.label ?? "", added: new Date(e.created_at).toLocaleString() })));
+}
+async function vpsAllowlistAddCommand(cidr, opts) {
+  const config = requireProject();
+  await apiRequest(`/api/projects/${config.projectId}/vps/allowlist`, {
+    method: "POST",
+    body: JSON.stringify({ cidr, label: opts.label })
+  });
+  console.log(`\u2713 Allowed ${cidr}${opts.label ? ` (${opts.label})` : ""} to reach this project's raw Postgres/Redis ports`);
+}
+async function vpsAllowlistRemoveCommand(id, opts) {
+  const config = requireProject();
+  await confirmOrDie(`Remove allowlist entry ${id}?`, opts.yes);
+  await apiRequest(`/api/projects/${config.projectId}/vps/allowlist/${encodeURIComponent(id)}`, { method: "DELETE" });
+  console.log(`\u2713 Allowlist entry ${id} removed`);
+}
+async function vpsEnvCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/env`);
+  if (data.vars.length === 0) {
+    console.log("No VPS env vars set on the active project.");
+    return;
+  }
+  console.log("\nVPS-scoped env vars (written into the compute stack's .env; values are never returned by the API):\n");
+  for (const v of data.vars) console.log(`  ${v.key}`);
+  console.log("");
+}
+async function vpsSetEnvCommand(key, value) {
+  const config = requireProject();
+  await apiRequest(`/api/projects/${config.projectId}/vps/env`, {
+    method: "POST",
+    body: JSON.stringify({ key, value })
+  });
+  console.log(`\u2713 VPS env var '${key}' set \u2014 run 'deploro vps deploy' to apply it`);
+}
+async function vpsDeployCommand() {
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/vps/deploy`,
+    { method: "POST" }
+  );
+  console.log(`\u2713 VPS deploy triggered: ${data.deployment.id}`);
+  console.log("  Run 'deploro vps deployments' to see history, or 'deploro vps logs' once containers are up.");
+}
+async function vpsDeploymentsCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/deployments`);
+  if (data.deployments.length === 0) {
+    console.log("No VPS deployments yet. Run: deploro vps deploy");
+    return;
+  }
+  table(data.deployments.map((d) => ({
+    id: d.id,
+    status: d.status,
+    branch: d.git_branch ?? "",
+    started: new Date(d.created_at).toLocaleString(),
+    finished: d.finished_at ? new Date(d.finished_at).toLocaleString() : "(in progress)"
+  })));
+}
+async function vpsDeployStatusCommand(deploymentId) {
+  const config = requireProject();
+  let id = deploymentId;
+  if (!id) {
+    const list = await apiRequest(`/api/projects/${config.projectId}/vps/deployments`);
+    id = list.deployments[0]?.id;
+    if (!id) {
+      console.log("No VPS deployments yet.");
+      return;
+    }
+  }
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/deployments/${id}`);
+  const d = data.deployment;
+  console.log(`
+\u2500\u2500 VPS DEPLOYMENT ${d.id} \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`);
+  console.log(`  Status : ${d.status}`);
+  console.log(`  Branch : ${d.git_branch ?? "(none)"}`);
+  if (d.agent_error) console.log(`  Agent error: ${d.agent_error}`);
+  console.log(`
+\u2500\u2500 LOGS \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`);
+  console.log(typeof d.logs === "string" && d.logs.trim().length > 0 ? d.logs : "(no logs)");
+  console.log("");
+}
+async function vpsStatusCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/status`);
+  console.log("\n\u2500\u2500 COMPUTE SERVICES \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  if (data.servicesError) {
+    console.log(`  ${data.servicesError}`);
+  } else if (data.services.length === 0) {
+    console.log("  (none deployed \u2014 run: deploro vps deploy)");
+  } else {
+    for (const s of data.services) {
+      const running = (s.State ?? "").toLowerCase().includes("running");
+      console.log(`  ${running ? "\u25CF" : "\u25CB"} ${s.Service ?? "?"}  ${s.Status ?? s.State ?? ""}`);
+    }
+  }
+  console.log("\n\u2500\u2500 RAW POSTGRES \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(data.postgres ? `  ${data.postgres.running ? "\u25CF" : "\u25CB"} ${data.postgres.status}` : "  (not provisioned)");
+  console.log("\n\u2500\u2500 RAW REDIS \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(data.redis ? `  ${data.redis.running ? "\u25CF" : "\u25CB"} ${data.redis.status}` : "  (not provisioned)");
+  console.log("");
+}
+async function vpsLogsCommand(service, opts) {
+  const config = requireProject();
+  const tail = Math.min(Math.max(parseInt(opts.tail ?? "200", 10) || 200, 1), 5e3);
+  const qs = new URLSearchParams({ tail: String(tail) });
+  if (service) qs.set("service", service);
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/logs?${qs.toString()}`);
+  console.log(data.logs.trim().length > 0 ? data.logs : "(no logs)");
+}
+
 // src/index.ts
 var pkg = createRequire(import.meta.url)("../package.json");
 var program = new Command();
@@ -851,6 +1179,16 @@ auth.command("whoami").description("Show the current identity, and \u2014 for a
 auth.command("users").description("List platform users").action(authUsersCommand);
 auth.command("invite <email>").description("Invite a user by email").option("--admin", "Grant admin role").action(authInviteCommand);
 auth.command("site-url [url]").description("Get or set the active project's Auth Site URL (where end-user confirmation-email links redirect back to)").option("--clear", "Clear the Site URL \u2014 confirmation links fall back to the project's own deployment URL").action(authSiteUrlCommand);
+auth.command("stats").description("Show Auth-as-a-Service stats for the active project's end users").action(authStatsCommand);
+var authProviders = auth.command("providers").description("Manage the active project's end-user sign-in providers");
+authProviders.command("list").description("List sign-in providers and their status").action(authProvidersListCommand);
+authProviders.command("enable <provider>").description("Enable a sign-in provider (e.g. email, email_password, google, github, apple, ...)").action((provider) => authProviderEnableCommand(provider, true));
+authProviders.command("disable <provider>").description("Disable a sign-in provider").action((provider) => authProviderEnableCommand(provider, false));
+authProviders.command("configure <provider>").description("Set OAuth client credentials for a provider (not applicable to email / email_password)").option("--client-id <id>", "OAuth client ID").option("--client-secret <secret>", "OAuth client secret (Apple: the .p8 private key contents)").option("--team-id <id>", "Apple only \u2014 Team ID").option("--key-id <id>", "Apple only \u2014 Key ID").action(authProviderConfigureCommand);
+var authEndUsers = auth.command("end-users").description("Manage the active project's end users (your app's sign-ups)");
+authEndUsers.command("list").description("List end users").option("--page <n>", "Page number", "1").action(authEndUsersListCommand);
+authEndUsers.command("add <email>").description("Manually add an end user \u2014 sends a confirmation email; they can't sign in until they click it").option("--name <name>", "Display name").action(authEndUserAddCommand);
+authEndUsers.command("delete <id>").description("Delete an end user and all their sign-in methods/sessions").option("--yes", "Skip confirmation prompt").action(authEndUserDeleteCommand);
 var token = program.command("token").description("Personal access token commands");
 token.command("list").description("List your personal access tokens").action(tokenListCommand);
 token.command("create <name>").description("Create a new project-scoped personal access token").option("--read", "Grant read scope").option("--write", "Grant write scope").option("--project <slugs>", "Comma-separated project slugs/ids/names (defaults to the active project)").option("--days <n>", "Expiry in days (1-365)", "90").action(tokenCreateCommand);
@@ -864,6 +1202,26 @@ var deploy = program.command("deploy").description("Deployment commands");
 deploy.command("trigger").description("Trigger a manual deployment").action(deployCommand);
 deploy.command("status").description("Show latest deployment status").action(deployStatusCommand);
 deploy.command("logs [deployment-id]").description("Show logs for a deployment (defaults to latest)").action(deployLogsCommand);
+var vps = program.command("vps").description("VPS compute hosting commands (raw Postgres/Redis, custom docker-compose deploys)");
+var vpsDatabase = vps.command("database").description("Raw Postgres (dedicated container, real connection string \u2014 for drizzle-kit, transactions, etc.)");
+vpsDatabase.command("create").description("Provision raw Postgres (idempotent; connection string shown once)").action(vpsDatabaseCreateCommand);
+vpsDatabase.command("info").description("Show raw Postgres connection info (no password)").action(vpsDatabaseInfoCommand);
+vpsDatabase.command("rotate").description("Rotate the raw Postgres password").option("--yes", "Skip confirmation prompt").action(vpsDatabaseRotateCommand);
+var vpsRedis = vps.command("redis").description("Raw Redis (dedicated container \u2014 for BullMQ, ioredis, Lua EVAL scripts)");
+vpsRedis.command("create").description("Provision raw Redis (idempotent; connection string shown once)").action(vpsRedisCreateCommand);
+vpsRedis.command("info").description("Show raw Redis connection info (no password)").action(vpsRedisInfoCommand);
+vpsRedis.command("rotate").description("Rotate the raw Redis password").option("--yes", "Skip confirmation prompt").action(vpsRedisRotateCommand);
+var vpsAllowlist = vps.command("allowlist").description("IP allowlist gating access to raw Postgres/Redis ports");
+vpsAllowlist.command("list").description("List allowlist entries").action(vpsAllowlistListCommand);
+vpsAllowlist.command("add <cidr>").description("Allow an IP or CIDR block (e.g. 203.0.113.4 or 203.0.113.0/24)").option("--label <label>", "Human-readable label").action(vpsAllowlistAddCommand);
+vpsAllowlist.command("remove <id>").description("Remove an allowlist entry").option("--yes", "Skip confirmation prompt").action(vpsAllowlistRemoveCommand);
+vps.command("env").description("List VPS-scoped env var names set on the active project (values are never returned)").action(vpsEnvCommand);
+vps.command("set-env <key> <value>").description("Set a VPS-scoped env var (e.g. JWT_SECRET) \u2014 distinct from 'hosting set-env', which sets Worker secrets").action(vpsSetEnvCommand);
+vps.command("deploy").description("Build and start the active project's docker-compose stack on the VPS").action(vpsDeployCommand);
+vps.command("deployments").description("List VPS deploy history").action(vpsDeploymentsCommand);
+vps.command("deploy-status [deployment-id]").description("Show a VPS deployment's status and logs (defaults to latest)").action(vpsDeployStatusCommand);
+vps.command("status").description("Show running compute services + raw Postgres/Redis container status").action(vpsStatusCommand);
+vps.command("logs [service]").description("Tail logs for a compute service (or 'postgres'/'redis')").option("--tail <n>", "Number of lines", "200").action(vpsLogsCommand);
 program.parseAsync().catch((err) => {
   console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploro",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "description": "Command-line interface for the Deploro developer platform — manage projects, databases, deployments, and hosting from your terminal.",
   "type": "module",
   "bin": {