ninedeploy 0.10.6 → 0.16.1

package/src/commands/upload.ts

@@ -0,0 +1,111 @@
+import { spawn } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import type { NineDeployClient } from '../client.js';
+import { error, info, spinner, success } from '../lib/format.js';
+
+/** The panel's limit for one upload (POST /v1/services/:id/source). */
+export const UPLOAD_MAX_BYTES = 100 * 1024 * 1024;
+
+/** Never part of a build context: VCS data, dependency trees, build output, local env files. */
+export const DEFAULT_EXCLUDES = ['.git', 'node_modules', '.next', '.nuxt', '.svelte-kit', '.turbo', '.cache', '.venv', '__pycache__', '.env', '.env.*', '.DS_Store'];
+
+/** `tar -czf` of `dir` (its contents, not the folder) into a buffer, with the excludes. */
+export async function packDirectory(dir: string, excludes: string[]): Promise<Buffer> {
+  const work = mkdtempSync(path.join(tmpdir(), 'nd-up-'));
+  const out = path.join(work, 'source.tar.gz');
+  try {
+    await new Promise<void>((resolve, reject) => {
+      // Relative -f with cwd: GNU tar reads a drive-letter colon (C:\…) as a remote host.
+      const args = ['-czf', path.basename(out), ...excludes.map((e) => `--exclude=${e}`), '-C', dir, '.'];
+      const child = spawn('tar', args, { cwd: work, stdio: ['ignore', 'ignore', 'pipe'] });
+      let stderr = '';
+      child.stderr.on('data', (d: Buffer) => (stderr += d.toString()));
+      child.on('error', reject);
+      child.on('close', (code) => (code === 0 ? resolve() : reject(new Error(`tar exited ${code}: ${stderr.trim()}`))));
+    });
+    return readFileSync(out);
+  } finally {
+    rmSync(work, { recursive: true, force: true });
+  }
+}
+
+export interface DeployUpOptions {
+  service?: string;
+  create?: string;
+  port?: string;
+  deploy?: boolean;
+  exclude?: string[];
+}
+
+/**
+ * `ninedeploy deploy up [dir]` (0.16.1): pack a local folder (or send a
+ * ready .zip / .tar.gz) and deploy it as the service's source — no Git
+ * repository needed. `--service` names an existing upload-sourced service
+ * (id or slug); `--create <name>` makes a new docker service for it.
+ */
+export async function deployUp(
+  client: NineDeployClient,
+  target: string | undefined,
+  opts: DeployUpOptions,
+  deps: { pack?: typeof packDirectory } = {},
+): Promise<void> {
+  const pack = deps.pack ?? packDirectory;
+  const where = path.resolve(target ?? '.');
+  if (!existsSync(where)) return error(`${where} does not exist.`);
+  if (!opts.service && !opts.create) {
+    return error('Name the service: --service <id|slug> for an existing one, or --create <name> for a new one.');
+  }
+  try {
+    let archive: Buffer;
+    if (statSync(where).isDirectory()) {
+      const excludes = [...DEFAULT_EXCLUDES, ...(opts.exclude ?? [])];
+      archive = await spinner(`Packing ${where}`, () => pack(where, excludes));
+    } else if (/\.(zip|tar\.gz|tgz)$/i.test(where)) {
+      archive = readFileSync(where);
+    } else {
+      return error('Pass a folder, a .zip or a .tar.gz.');
+    }
+    if (archive.length > UPLOAD_MAX_BYTES) {
+      return error(
+        `The archive is ${(archive.length / 1024 / 1024).toFixed(1)} MiB; the panel takes up to ${UPLOAD_MAX_BYTES / 1024 / 1024} MiB. ` +
+          'Exclude build output or dependencies with --exclude <pattern>.',
+      );
+    }
+
+    let serviceId: number;
+    if (opts.create) {
+      const port = opts.port ? Number(opts.port) : undefined;
+      if (opts.port && (!Number.isInteger(port) || port! < 1 || port! > 65535)) return error('--port must be a port number.');
+      const svc = await spinner(`Creating service ${opts.create}`, () =>
+        client.services.create({ name: opts.create!, type: 'docker', ...(port ? { port } : {}) }),
+      );
+      serviceId = svc.id;
+      info(`Service #${svc.id} (${svc.slug}) created.`);
+    } else {
+      const ref = opts.service!;
+      if (/^\d+$/.test(ref)) {
+        serviceId = Number(ref);
+      } else {
+        const found = (await client.services.list()).find((s) => s.slug === ref || s.name === ref);
+        if (!found) return error(`No service named "${ref}".`);
+        serviceId = found.id;
+      }
+    }
+
+    const sizeMiB = (archive.length / 1024 / 1024).toFixed(1);
+    const res = await spinner(`Uploading ${sizeMiB} MiB`, () =>
+      client.services.uploadSource(serviceId, new Uint8Array(archive.buffer, archive.byteOffset, archive.length), { deploy: opts.deploy !== false }),
+    );
+    success(`Uploaded ${res.sha.slice(0, 7)} (${res.entries} entries).`);
+    if (res.deploymentId != null) {
+      success(`Deployment #${res.deploymentId} queued.`);
+      info(`Watch logs: ninedeploy services logs ${serviceId}`);
+    } else {
+      info(`Stored only. Deploy it with: ninedeploy services deploy ${serviceId}`);
+    }
+  } catch (err) {
+    error(err instanceof Error ? err.message : String(err));
+  }
+}

package/src/commands/webhooks.ts

@@ -0,0 +1,93 @@
+import type { NineDeployClient } from '../client.js';
+import { prompt } from '../prompts.js';
+import { c, error, header, info, kv, spinner, success, table } from '../lib/format.js';
+
+/** `ninedeploy webhooks list <serviceId>` */
+export async function webhooksList(client: NineDeployClient, svcArg: string): Promise<void> {
+  const serviceId = Number(svcArg);
+  if (!serviceId) return error('Usage: ninedeploy webhooks list <serviceId>');
+  header(`Webhooks for service #${serviceId}`);
+  const rows = await spinner('Fetching', () => client.webhooks.list(serviceId));
+  if (rows.length === 0) {
+    info('No webhooks yet. Add one with `ninedeploy webhooks add`.');
+    return;
+  }
+  table(
+    rows.map((w) => ({
+      id: w.id,
+      branch: w.branch,
+      source: w.sourceId ?? c.gray('—'),
+      active: w.active ? c.green('✓') : c.red('✗'),
+      url: w.url,
+    })),
+    ['id', 'branch', 'source', 'active', 'url'],
+  );
+}
+
+/**
+ * `ninedeploy webhooks add <serviceId> [branch]`
+ *
+ * Returns the secret ONCE so the operator can paste it into GitHub as the
+ * webhook "Secret" value. The CLI never stores it; the panel only ever sees
+ * the HMAC digest.
+ */
+export async function webhooksAdd(client: NineDeployClient, svcArg: string, branchArg?: string): Promise<void> {
+  const serviceId = Number(svcArg);
+  if (!serviceId) return error('Usage: ninedeploy webhooks add <serviceId> [branch]');
+  const branch = branchArg ?? (await prompt('Branch to deploy on push', 'main'));
+  if (!branch) return error('Branch is required');
+
+  const watchPaths = (await prompt('Watch paths (newline/comma-separated globs; empty = all files)', '')) || undefined;
+
+  const created = await spinner('Creating webhook', () =>
+    client.webhooks.create(serviceId, { branch, watchPaths }),
+  );
+  success(`Webhook #${created.id} created for branch "${created.branch}"`);
+  console.log();
+  console.log(`  ${c.bold('URL')}`);
+  console.log(`    ${c.cyan(created.url)}`);
+  console.log();
+  console.log(`  ${c.bold('Secret (shown once — paste into GitHub):')}`);
+  console.log(`    ${c.green(created.secret)}`);
+  console.log();
+  console.log(`  ${c.gray('GitHub steps: Repo → Settings → Webhooks → Add')}`);
+  console.log(`  ${c.gray('  • Payload URL  : the URL above')}`);
+  console.log(`  ${c.gray('  • Content type : application/json')}`);
+  console.log(`  ${c.gray('  • Secret       : the secret above')}`);
+  console.log(`  ${c.gray('  • SSL          : enabled (the panel runs behind HTTPS via Traefik)')}`);
+  console.log(`  ${c.gray('  • Events       : "Just the push event."')}`);
+  console.log();
+  info('Tip: set `NINEDEPLOY_PUBLIC_URL` on the server to a public HTTPS URL so the URL is reachable from GitHub.');
+}
+
+/** `ninedeploy webhooks remove <serviceId> <hookId>` */
+export async function webhooksRemove(client: NineDeployClient, svcArg: string, hookArg: string): Promise<void> {
+  const serviceId = Number(svcArg);
+  const hookId = Number(hookArg);
+  if (!serviceId || !hookId) return error('Usage: ninedeploy webhooks remove <serviceId> <hookId>');
+  const confirm = await prompt(`Type "delete" to confirm removal of webhook #${hookId}`, '');
+  if (confirm.trim() !== 'delete') {
+    info('Aborted.');
+    return;
+  }
+  await spinner('Removing webhook', () => client.webhooks.remove(serviceId, hookId));
+  success(`Webhook #${hookId} removed.`);
+}
+
+/** `ninedeploy webhooks show <serviceId> <hookId>` */
+export async function webhooksShow(client: NineDeployClient, svcArg: string, hookArg: string): Promise<void> {
+  const serviceId = Number(svcArg);
+  const hookId = Number(hookArg);
+  if (!serviceId || !hookId) return error('Usage: ninedeploy webhooks show <serviceId> <hookId>');
+  header(`Webhook #${hookId}`);
+  const rows = await spinner('Fetching', () => client.webhooks.list(serviceId));
+  const w = rows.find((x) => x.id === hookId);
+  if (!w) return error(`Webhook #${hookId} not found on service #${serviceId}`);
+  kv('ID', w.id);
+  kv('Branch', w.branch);
+  kv('Source', w.sourceId ?? c.gray('— (inherits service default)'));
+  kv('Active', w.active ? c.green('yes') : c.red('no'));
+  kv('Watch paths', w.watchPaths || c.gray('— (all files)'));
+  kv('URL', w.url);
+  kv('Created', w.createdAt);
+}

package/src/commands/workspaces.ts

@@ -0,0 +1,63 @@
+import type { NineDeployClient } from '@ninedeploy/sdk';
+import { spinner, table } from '../lib/format.js';
+
+export async function workspacesList(client: NineDeployClient): Promise<void> {
+  const list = await spinner('Fetching workspaces', () => client.workspaces.list());
+  if (list.length === 0) {
+    console.log('  No workspaces found.');
+    return;
+  }
+  table(
+    list.map((w) => ({
+      id: w.id,
+      name: w.name,
+      slug: w.slug,
+      role: w.myRole,
+      members: w.memberCount,
+      projects: w.projectCount,
+      created: new Date(w.createdAt).toLocaleDateString(),
+    })),
+    ['id', 'name', 'slug', 'role', 'members', 'projects', 'created'],
+  );
+}
+
+export async function workspacesGet(client: NineDeployClient, id: string): Promise<void> {
+  const wsId = Number.parseInt(id, 10);
+  if (Number.isNaN(wsId)) {
+    throw new Error('Workspace ID must be an integer');
+  }
+  const ws = await spinner('Fetching workspace', () => client.workspaces.get(wsId));
+  console.log(`\n  Workspace #${ws.id}: ${ws.name} (${ws.slug})`);
+  console.log(`  Role:        ${ws.myRole}`);
+  if (ws.description) console.log(`  Description: ${ws.description}`);
+  console.log(`  Created:     ${new Date(ws.createdAt).toLocaleString()}`);
+  console.log('\n  Members:');
+  table(
+    ws.members.map((m) => ({
+      userId: m.userId,
+      nameEmail: m.name ? `${m.name} <${m.email}>` : m.email,
+      role: m.role,
+      joined: new Date(m.createdAt).toLocaleDateString(),
+    })),
+    ['userId', 'nameEmail', 'role', 'joined'],
+  );
+}
+
+export async function workspacesCreate(client: NineDeployClient, name: string, opts: { description?: string }): Promise<void> {
+  const ws = await spinner('Creating workspace', () =>
+    client.workspaces.create({
+      name,
+      description: opts.description,
+    }),
+  );
+  console.log(`  ✓ Workspace #${ws.id} created: ${ws.name} (${ws.slug})`);
+}
+
+export async function workspacesDelete(client: NineDeployClient, id: string): Promise<void> {
+  const wsId = Number.parseInt(id, 10);
+  if (Number.isNaN(wsId)) {
+    throw new Error('Workspace ID must be an integer');
+  }
+  await spinner('Deleting workspace', () => client.workspaces.delete(wsId));
+  console.log(`  ✓ Workspace #${wsId} deleted.`);
+}

package/src/config.ts

@@ -0,0 +1,53 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import path from 'node:path';
+
+const CONFIG_DIR = path.join(homedir(), '.ninedeploy');
+const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
+
+export interface CliConfig {
+  baseUrl: string;
+  token?: string;
+  /** Long-lived token used to mint fresh access tokens (see client.ts). */
+  refreshToken?: string;
+}
+
+const DEFAULTS: CliConfig = { baseUrl: 'http://localhost:3000' };
+
+export function loadConfig(): CliConfig {
+  try {
+    if (existsSync(CONFIG_FILE)) {
+      return { ...DEFAULTS, ...(JSON.parse(readFileSync(CONFIG_FILE, 'utf8')) as Partial<CliConfig>) };
+    }
+  } catch (err) {
+    // A torn/partial write used to fall back to defaults SILENTLY — the user
+    // was logged out with no hint the file was ever corrupt. Say so.
+    // eslint-disable-next-line no-console
+    console.error(`⚠ Could not read ${CONFIG_FILE} (${err instanceof Error ? err.message : String(err)}); using defaults.`);
+  }
+  return { ...DEFAULTS };
+}
+
+export function saveConfig(config: CliConfig): void {
+  mkdirSync(CONFIG_DIR, { recursive: true });
+  // Temp-file + rename: a crash mid-write must never leave a half-written
+  // config behind (the previous direct write could, logging the user out on
+  // the next command with no explanation).
+  const tmp = `${CONFIG_FILE}.${randomUUID()}.tmp`;
+  writeFileSync(tmp, JSON.stringify(config, null, 2), { mode: 0o600 });
+  try {
+    renameSync(tmp, CONFIG_FILE);
+  } catch (err) {
+    try { unlinkSync(tmp); } catch { /* already gone */ }
+    throw err;
+  }
+  // writeFileSync's mode only applies at CREATION — re-assert 0600 so a file
+  // that ever ended up group/world-readable (restore, copy, old version)
+  // holding the bearer token is tightened on every save.
+  try {
+    chmodSync(CONFIG_FILE, 0o600);
+  } catch {
+    /* best-effort on exotic filesystems */
+  }
+}