ninedeploy 0.18.25 → 0.18.27

package/src/lib/importers/connections.ts

@@ -0,0 +1,133 @@
+/**
+ * A1: environment values copied from the source that still point at the
+ * source's databases.
+ *
+ * A .env file passed to `import apply --dotenv` is read here, on the person's
+ * machine; what comes out holds variable names, database names and host
+ * names, never a value. Each hit is either:
+ * - `attach`: the value is a connection string the panel's own one can
+ *   replace exactly, so the new database is attached under that variable's
+ *   name (the attachment sets it at every deploy);
+ * - `manual`: anything else, with the reason. The panel's string has a fixed
+ *   form per engine (scheme, no query options, no Mongo database name, no
+ *   Redis database index), and replacing a value that differs would change
+ *   what the app connects to without anyone seeing it.
+ */
+import type { ImportPlan, PlanDatabase, PlanEngine, SourceKind } from './plan.js';
+
+/** The scheme each engine's panel connection string starts with (server engine/database.ts). */
+const PANEL_SCHEME: Record<PlanEngine, string> = {
+  postgres: 'postgres:', mysql: 'mysql:', mariadb: 'mariadb:', mongo: 'mongodb:',
+  redis: 'redis:', keydb: 'redis:', dragonfly: 'redis:', clickhouse: 'clickhouse:',
+};
+const REDIS_FAMILY = new Set<PlanEngine>(['redis', 'keydb', 'dragonfly']);
+
+/**
+ * The names the source's apps reach a database by, from where it runs.
+ * CapRover: both the app name and the `srv-captain--` alias (1.16 names new
+ * apps' Swarm services plainly, older ones with the prefix). Coolify: the
+ * container name (its uuid). Dokploy: the Swarm service (appName).
+ */
+export function sourceHosts(kind: SourceKind, db: PlanDatabase): string[] {
+  const name = db.runtime?.name?.toLowerCase();
+  if (!name) return [];
+  switch (db.runtime!.kind) {
+    case 'heroku-app':
+      // The name is the Heroku app, not a host: add-on URLs name Heroku's own hosts.
+      return [];
+    case 'container':
+    case 'swarm-service':
+      break;
+    default: {
+      const never: never = db.runtime!.kind;
+      return never;
+    }
+  }
+  if (kind === 'caprover') {
+    const app = name.replace(/^srv-captain--/, '');
+    return [app, `srv-captain--${app}`];
+  }
+  return [name];
+}
+
+/** `KEY=value` pairs of a .env file: quotes removed, `# comments` after an unquoted value dropped. */
+export function envFileEntries(content: string): Array<{ key: string; value: string }> {
+  const out: Array<{ key: string; value: string }> = [];
+  for (const line of content.split(/\r?\n/)) {
+    const m = /^[ \t]*(?:export[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*=[ \t]*(.*)$/.exec(line);
+    if (!m) continue;
+    let value = m[2]!;
+    const q = value[0];
+    if ((q === '"' || q === "'") && value.indexOf(q, 1) > 0) value = value.slice(1, value.indexOf(q, 1));
+    else value = value.replace(/[ \t]+#.*$/, '').trim();
+    out.push({ key: m[1]!, value });
+  }
+  return out;
+}
+
+export interface ConnectionHit {
+  key: string;
+  /** The plan database it names (null: the source platform's own host). */
+  database: PlanDatabase | null;
+  host: string;
+  action: 'attach' | 'manual';
+  reason: string;
+}
+
+function parseUrl(value: string): URL | null {
+  if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) return null;
+  try {
+    return new URL(value);
+  } catch {
+    return null;
+  }
+}
+
+/** Why the panel's string cannot replace this one, or null when it can. */
+function attachProblem(engine: PlanEngine, url: URL): string | null {
+  const want = PANEL_SCHEME[engine];
+  if (engine === 'mongo') return 'the panel\'s Mongo string names no database, so the app would use the default one; set the new host and credentials here, keeping the database name';
+  if (engine === 'clickhouse') return 'ClickHouse is not attached by the import; set the new host and credentials here';
+  if (url.protocol !== want) return `the panel's string starts with ${want}// and this one with ${url.protocol}//, which the app's driver may need`;
+  if (url.search) return 'it carries options (?…) that the panel\'s string would drop';
+  if (REDIS_FAMILY.has(engine) && url.pathname !== '' && url.pathname !== '/' && url.pathname !== '/0') return `it selects Redis database ${url.pathname.slice(1)}, and the panel's string uses 0`;
+  return null;
+}
+
+/** Every value in the file that names a planned database's source host, or the source platform's own host. */
+export function findConnections(plan: ImportPlan, envContent: string): ConnectionHit[] {
+  const byHost = new Map<string, PlanDatabase>();
+  for (const db of plan.databases) for (const h of sourceHosts(plan.source.kind, db)) byHost.set(h, db);
+  let platform: string | null = null;
+  try {
+    // A Heroku plan's URL is the repository, not a host the app could reach a database on.
+    if (plan.source.kind !== 'heroku') platform = new URL(plan.source.url).hostname.toLowerCase().replace(/^\[|\]$/g, '');
+  } catch {
+    platform = null;
+  }
+  const hits: ConnectionHit[] = [];
+  for (const { key, value } of envFileEntries(envContent)) {
+    const url = parseUrl(value);
+    const host = (url ? url.hostname : value.replace(/:\d+$/, '')).toLowerCase().replace(/^\[|\]$/g, '');
+    if (!host) continue;
+    const db = byHost.get(host);
+    if (db) {
+      if (!url) {
+        hits.push({ key, database: db, host, action: 'manual', reason: `it holds the source database's host; set it to ${db.name}'s host in NineDeploy (Databases → ${db.name} → Connection)` });
+        continue;
+      }
+      const problem = db.engine ? attachProblem(db.engine, url) : 'NineDeploy has no managed equivalent of this database';
+      hits.push(problem
+        ? { key, database: db, host, action: 'manual', reason: problem }
+        : { key, database: db, host, action: 'attach', reason: '' });
+      continue;
+    }
+    if (platform && host === platform && !url?.protocol.startsWith('http')) {
+      hits.push({
+        key, database: null, host, action: 'manual',
+        reason: 'NineDeploy can still reach that host, so the app would keep using the old database. Point it at the new one',
+      });
+    }
+  }
+  return hits;
+}

package/src/lib/importers/coolify.ts

@@ -0,0 +1,164 @@
+/**
+ * Coolify v4 (field names checked against v4.7.0, eaaaf7a7): REST under
+ * /api/v1 with a team-bound Bearer token. A `read` token is enough for a plan:
+ * values that need `read:sensitive` (env values, compose YAML, passwords) are
+ * never asked for. Databases come from /databases, not from per-environment
+ * lists, which leave out KeyDB, Dragonfly, ClickHouse and SQLite.
+ */
+import {
+  cpusToMilli, DATA_NOT_MOVED, domainsFrom, emptyPlan, firstVolumeMount, memToMb, stripUserinfo,
+  type ImportPlan, type PlanDatabase, type PlanEngine, type PlanIssue, type PlanService, type SourceGet,
+} from './plan.js';
+
+type Obj = Record<string, unknown>;
+const str = (v: unknown): string | undefined => (typeof v === 'string' && v.trim() ? v.trim() : undefined);
+const list = (v: unknown): Obj[] => (Array.isArray(v) ? (v as Obj[]) : []);
+
+const ENGINES: Record<string, PlanEngine | null> = {
+  'standalone-postgresql': 'postgres',
+  'standalone-mysql': 'mysql',
+  'standalone-mariadb': 'mariadb',
+  'standalone-mongodb': 'mongo',
+  'standalone-redis': 'redis',
+  'standalone-keydb': 'keydb',
+  'standalone-dragonfly': 'dragonfly',
+  'standalone-clickhouse': 'clickhouse',
+  'standalone-sqlite': null,
+};
+
+/** Coolify git_repository is a URL, or `owner/repo` for GitHub sources. */
+function repoUrlOf(app: Obj, issues: PlanIssue[]): string | undefined {
+  const full = str(app['git_full_url']) ?? str(app['git_repository']);
+  if (!full) return undefined;
+  if (/^(https?|ssh|git):\/\//i.test(full) || /^[^@\s]+@[^:\s]+:/.test(full)) return stripUserinfo(full);
+  if (/^[\w.-]+\/[\w.-]+$/.test(full)) {
+    issues.push({ level: 'info', option: 'git_repository', detail: `"${full}" read as a GitHub repository.` });
+    return `https://github.com/${full}`;
+  }
+  return stripUserinfo(full);
+}
+
+async function envKeys(get: SourceGet, path: string): Promise<Array<{ key: string }>> {
+  const rows = list(await get(path));
+  const keys = new Set<string>();
+  // Preview variables (is_preview) belong to PR previews, not the service itself.
+  for (const r of rows) if (r['is_preview'] !== true && str(r['key'])) keys.add(String(r['key']));
+  return [...keys].map((key) => ({ key }));
+}
+
+async function volumesOf(get: SourceGet, path: string): Promise<PlanService['volumes']> {
+  const s = (await get(path)) as Obj | null;
+  const out: PlanService['volumes'] = [];
+  for (const v of list(s?.['persistent_storages'])) {
+    const mountPath = str(v['mount_path']);
+    if (mountPath) out.push({ mountPath, source: str(v['host_path']) ? 'bind' : 'volume', name: str(v['name']) });
+  }
+  for (const v of list(s?.['file_storages'])) {
+    const mountPath = str(v['mount_path']);
+    if (mountPath) out.push({ mountPath, source: 'file' });
+  }
+  return out;
+}
+
+async function applicationItem(get: SourceGet, app: Obj): Promise<PlanService> {
+  const ref = String(app['uuid']);
+  const name = str(app['name']) ?? ref;
+  const issues: PlanIssue[] = [];
+  const pack = str(app['build_pack']) ?? 'nixpacks';
+  const base = { name, type: 'docker' as const };
+  let kind: PlanService['kind'] = 'git';
+  let create: PlanService['create'] = base;
+
+  if (pack === 'dockerimage') {
+    kind = 'image';
+    const image = str(app['docker_registry_image_name']);
+    const tag = str(app['docker_registry_image_tag']) ?? 'latest';
+    create = { ...base, image: image ? `${image}:${tag}` : undefined };
+    if (!image) issues.push({ level: 'manual', option: 'docker_registry_image_name', detail: 'No image name in the source; set one before importing.' });
+  } else if (pack === 'dockercompose') {
+    kind = 'compose';
+    create = { name, type: 'compose', repoUrl: repoUrlOf(app, issues), branch: str(app['git_branch']) };
+    const loc = str(app['docker_compose_location']);
+    issues.push({ level: 'info', option: 'docker_compose_location', detail: `Compose file ${loc ?? '/docker-compose.yaml'} in the repository; NineDeploy reads it from there.` });
+  } else {
+    const buildPack = pack === 'nixpacks' || pack === 'static' || pack === 'dockerfile' || pack === 'railpack' ? pack : 'auto';
+    if (buildPack === 'auto') issues.push({ level: 'unsupported', option: 'build_pack', detail: `Build pack "${pack}" has no NineDeploy equivalent; the plan uses auto-detect.` });
+    const dockerfile = str(app['dockerfile_location'])?.replace(/^\/+/, '');
+    create = {
+      ...base,
+      repoUrl: repoUrlOf(app, issues),
+      branch: str(app['git_branch']),
+      build: {
+        buildPack,
+        baseDir: str(app['base_directory']) ?? '/',
+        ...(buildPack === 'dockerfile' && dockerfile ? { dockerfilePath: dockerfile } : {}),
+        ...(buildPack === 'static' && str(app['publish_directory']) ? { outputDir: str(app['publish_directory'])!.replace(/^\/+/, '') } : {}),
+      },
+    };
+    if (!create.repoUrl) issues.push({ level: 'manual', option: 'git_repository', detail: 'No repository in the source.' });
+  }
+  const sourceType = str(app['source_type']) ?? '';
+  // Coolify gives every app made from a public repository its built-in "Public GitHub"
+  // source, GithubApp id 0 (checked live on 4.7.5). Only another source needs credentials.
+  const publicSource = /GithubApp/i.test(sourceType) && app['source_id'] != null && Number(app['source_id']) === 0;
+  const gitSource = /Github|Gitlab|Gitea|Bitbucket/i.test(sourceType) && !publicSource;
+  // A read token hides private_key_id, so a deploy-key app shows as an SSH repository URL.
+  const sshRepo = /^(ssh:\/\/|[^@\s/]+@[^:\s]+:)/i.test(str(app['git_repository']) ?? '');
+  if (gitSource || app['private_key_id'] != null || sshRepo || str(app['git_https_username'])) {
+    issues.push({ level: 'manual', option: 'source', detail: 'Private repository access does not transfer: reconnect it in NineDeploy (GitHub App, token or deploy key).' });
+  }
+
+  const ports = (str(app['ports_exposes']) ?? '').split(',').map((p) => Number(p.trim())).filter((p) => Number.isInteger(p) && p > 0 && p < 65536);
+  if (ports[0]) create.port = ports[0];
+  if (ports.length > 1) issues.push({ level: 'info', option: 'ports_exposes', detail: `Exposes ${ports.join(', ')}; NineDeploy routes one port (${ports[0]}).` });
+  const mapping = str(app['ports_mappings']);
+  if (mapping) issues.push({ level: 'manual', option: 'ports_mappings', detail: `Host port mappings (${mapping}) are not carried; set Public Host Port or port mappings by hand.` });
+  if (app['health_check_enabled'] === true && str(app['health_check_path'])) create.healthPath = str(app['health_check_path']);
+  const mem = memToMb(str(app['limits_memory']));
+  if (mem) create.memLimitMb = mem;
+  const cpu = cpusToMilli(str(app['limits_cpus']));
+  if (cpu) create.cpuLimitMilli = cpu;
+
+  const volumes = kind === 'compose' ? [] : await volumesOf(get, `/api/v1/applications/${ref}/storages`);
+  const mount = kind === 'compose' ? undefined : firstVolumeMount(volumes, issues);
+  if (mount) create.volumeMount = mount;
+  return {
+    ref, name, kind, create,
+    domains: domainsFrom(str(app['fqdn'])),
+    env: await envKeys(get, `/api/v1/applications/${ref}/envs`),
+    volumes, issues,
+  };
+}
+
+async function serviceStackItem(get: SourceGet, svc: Obj): Promise<PlanService> {
+  const ref = String(svc['uuid']);
+  const name = str(svc['name']) ?? ref;
+  const issues: PlanIssue[] = [
+    { level: 'manual', option: 'docker_compose', detail: 'The stack\'s compose file needs a read:sensitive token to read; paste it into a new compose service.' },
+  ];
+  const template = str(svc['service_type']);
+  if (template) issues.push({ level: 'info', option: 'service_type', detail: `Coolify one-click template "${template}"; the NineDeploy Hub may have an equivalent.` });
+  const detail = (await get(`/api/v1/services/${ref}`)) as Obj | null;
+  const domains = list(detail?.['applications']).flatMap((a) => domainsFrom(str(a['fqdn'])));
+  return { ref, name, kind: 'compose', create: { name, type: 'compose' }, domains, env: await envKeys(get, `/api/v1/services/${ref}/envs`), volumes: [], issues };
+}
+
+function databaseItem(db: Obj): PlanDatabase {
+  const type = str(db['database_type']) ?? '';
+  const engine = type in ENGINES ? ENGINES[type]! : null;
+  const issues: PlanIssue[] = [];
+  if (engine === null) issues.push({ level: 'unsupported', option: 'database_type', detail: type === 'standalone-sqlite' ? 'SQLite is a file inside an app, not a managed server; NineDeploy has no managed SQLite.' : `Unknown database type "${type}".` });
+  else issues.push(DATA_NOT_MOVED);
+  if (db['is_public'] === true) issues.push({ level: 'manual', option: 'is_public', detail: 'Public access was on; turn on public access in NineDeploy if you still need it.' });
+  // Coolify names a standalone database's container after its uuid.
+  return { ref: String(db['uuid']), name: str(db['name']) ?? String(db['uuid']), engine, image: str(db['image']) ?? null, runtime: { kind: 'container', name: String(db['uuid']) }, issues };
+}
+
+export async function planFromCoolify(get: SourceGet, url: string): Promise<ImportPlan> {
+  const version = await get('/api/v1/version').then((v) => (typeof v === 'string' ? v.trim() : null), () => null);
+  const plan = emptyPlan('coolify', url, version, 'the team the API token belongs to');
+  for (const app of list(await get('/api/v1/applications'))) plan.services.push(await applicationItem(get, app));
+  for (const svc of list(await get('/api/v1/services'))) plan.services.push(await serviceStackItem(get, svc));
+  for (const db of list(await get('/api/v1/databases'))) plan.databases.push(databaseItem(db));
+  return plan;
+}

package/src/lib/importers/dokploy.ts

@@ -0,0 +1,167 @@
+/**
+ * Dokploy (field names checked against v0.31.0, 3ac1c8f2): tRPC procedures
+ * exposed as REST by @dokploy/trpc-openapi, `GET /api/<procedure>?<input>`,
+ * with an `x-api-key` bound to one organization. There is no application.all:
+ * the plan walks project.all, then reads each item with its `*.one`.
+ *
+ * Dokploy returns secrets in plain text (decrypted env, database passwords,
+ * the registry password): the adapter reads names only and never copies a
+ * value into the plan.
+ */
+import {
+  DATA_NOT_MOVED, emptyPlan, envNames, firstVolumeMount, memToMb, planDomain, replicasFor, stripUserinfo,
+  type ImportPlan, type PlanDatabase, type PlanEngine, type PlanIssue, type PlanService, type SourceGet,
+} from './plan.js';
+
+type Obj = Record<string, unknown>;
+const str = (v: unknown): string | undefined => (typeof v === 'string' && v.trim() ? v.trim() : undefined);
+const list = (v: unknown): Obj[] => (Array.isArray(v) ? (v as Obj[]) : []);
+const q = (procedure: string, input: Record<string, string>) => `/api/${procedure}?${new URLSearchParams(input).toString()}`;
+
+/** The repository a Dokploy application or compose builds from, per source type. */
+function repoOf(row: Obj, issues: PlanIssue[]): { repoUrl?: string; branch?: string } {
+  const type = str(row['sourceType']);
+  const hosted = (host: string, owner?: string, repo?: string) => (owner && repo ? `https://${host}/${owner}/${repo}` : undefined);
+  let out: { repoUrl?: string; branch?: string } = {};
+  if (type === 'github') out = { repoUrl: hosted('github.com', str(row['owner']), str(row['repository'])), branch: str(row['branch']) };
+  else if (type === 'gitlab') out = { repoUrl: hosted('gitlab.com', str(row['gitlabOwner']), str(row['gitlabRepository'])), branch: str(row['gitlabBranch']) };
+  else if (type === 'bitbucket') out = { repoUrl: hosted('bitbucket.org', str(row['bitbucketOwner']), str(row['bitbucketRepository'])), branch: str(row['bitbucketBranch']) };
+  else if (type === 'gitea') {
+    out = { branch: str(row['giteaBranch']) };
+    issues.push({ level: 'manual', option: 'sourceType', detail: `Gitea repository ${str(row['giteaOwner']) ?? '?'}/${str(row['giteaRepository']) ?? '?'}: enter its URL by hand (the Gitea host is not in the record).` });
+  } else if (type === 'git') {
+    const raw = str(row['customGitUrl']);
+    out = { repoUrl: raw ? stripUserinfo(raw) : undefined, branch: str(row['customGitBranch']) };
+  }
+  if (type === 'github' || type === 'gitlab' || type === 'bitbucket' || type === 'gitea' || (type === 'git' && row['customGitSSHKeyId'] != null)) {
+    issues.push({ level: 'manual', option: 'source', detail: 'Repository access does not transfer: reconnect it in NineDeploy (GitHub App, token or deploy key).' });
+  }
+  if (type === 'gitlab' || type === 'bitbucket') issues.push({ level: 'info', option: 'sourceType', detail: `Assumed the hosted ${type === 'gitlab' ? 'gitlab.com' : 'bitbucket.org'}; change the URL for a self-hosted instance.` });
+  return out;
+}
+
+function volumesOf(mounts: unknown): PlanService['volumes'] {
+  const out: PlanService['volumes'] = [];
+  for (const m of list(mounts)) {
+    const mountPath = str(m['mountPath']);
+    if (!mountPath) continue;
+    const type = str(m['type']);
+    out.push({ mountPath, source: type === 'bind' ? 'bind' : type === 'file' ? 'file' : 'volume', name: str(m['volumeName']) });
+  }
+  return out;
+}
+
+const BUILD_PACKS: Record<string, NonNullable<NonNullable<PlanService['create']['build']>['buildPack']>> = {
+  nixpacks: 'nixpacks', dockerfile: 'dockerfile', static: 'static', railpack: 'railpack', heroku_buildpacks: 'heroku', paketo_buildpacks: 'paketo',
+};
+
+async function applicationItem(get: SourceGet, id: string): Promise<PlanService> {
+  const app = ((await get(q('application.one', { applicationId: id }))) ?? {}) as Obj;
+  const name = str(app['name']) ?? str(app['appName']) ?? id;
+  const issues: PlanIssue[] = [];
+  const base = { name, type: 'docker' as const };
+  const sourceType = str(app['sourceType']);
+  let kind: PlanService['kind'] = 'git';
+  let create: PlanService['create'] = base;
+  if (sourceType === 'docker') {
+    kind = 'image';
+    create = { ...base, image: str(app['dockerImage']) };
+    if (str(app['username']) || app['registryUrl']) issues.push({ level: 'manual', option: 'registry', detail: 'A private registry login does not transfer: add the registry credentials in NineDeploy.' });
+  } else if (sourceType === 'drop') {
+    issues.push({ level: 'unsupported', option: 'sourceType', detail: 'Uploaded ("drop") source: the archive is not readable over the API. Re-upload it as a ZIP source in NineDeploy.' });
+  } else {
+    const { repoUrl, branch } = repoOf(app, issues);
+    const buildType = str(app['buildType']) ?? 'nixpacks';
+    const buildPack = BUILD_PACKS[buildType] ?? 'auto';
+    if (buildPack === 'auto') issues.push({ level: 'unsupported', option: 'buildType', detail: `Build type "${buildType}" has no NineDeploy equivalent; the plan uses auto-detect.` });
+    const dockerfile = str(app['dockerfile']);
+    const base_dir = str(app['customGitBuildPath']) ?? str(app['buildPath']);
+    create = {
+      ...base, repoUrl, branch,
+      build: {
+        buildPack,
+        ...(base_dir ? { baseDir: base_dir } : {}),
+        ...(buildPack === 'dockerfile' && dockerfile ? { dockerfilePath: dockerfile.replace(/^\.?\/+/, '') } : {}),
+        ...(buildPack === 'static' && str(app['publishDirectory']) ? { outputDir: str(app['publishDirectory'])!.replace(/^\.?\/+/, '') } : {}),
+      },
+    };
+    if (!repoUrl && sourceType !== 'gitea') issues.push({ level: 'manual', option: 'repository', detail: 'No repository in the source.' });
+  }
+  const domains = list(app['domains']).map((d) => ({ host: str(d['host']) ?? '', https: d['https'] === true, port: Number(d['port']) })).filter((d) => d.host);
+  const port = domains.find((d) => Number.isInteger(d.port) && d.port > 0)?.port;
+  if (port) create.port = port;
+  const portsList = list(app['ports']);
+  if (portsList.length) issues.push({ level: 'manual', option: 'ports', detail: `${portsList.length} published port(s) (${portsList.map((p) => `${p['publishedPort']}:${p['targetPort']}`).join(', ')}); set Public Host Port or port mappings by hand.` });
+  const mem = memToMb(str(app['memoryLimit']) ?? (app['memoryLimit'] as number | undefined));
+  if (mem) create.memLimitMb = mem;
+  // Dokploy passes these straight to Docker: memoryLimit as MemoryBytes and
+  // cpuLimit as NanoCPUs (1e9 = one core), both as strings.
+  const nano = Number(app['cpuLimit']);
+  const cpu = Number.isFinite(nano) && nano > 0 ? Math.round(nano / 1_000_000) : undefined;
+  if (cpu) create.cpuLimitMilli = cpu;
+  const replicas = replicasFor(app['replicas'], issues);
+  if (replicas) create.replicas = replicas;
+  if (str(app['command'])) issues.push({ level: 'manual', option: 'command', detail: 'A custom start command is set; add it as the start command under Settings → Build & start.' });
+  const volumes = volumesOf(app['mounts']);
+  const mount = firstVolumeMount(volumes, issues);
+  if (mount) create.volumeMount = mount;
+  const appName = str(app['appName']);
+  return {
+    ref: id, name, kind, create, domains: domains.map(({ host, https }) => planDomain(host, https)), env: envNames(str(app['env'])), volumes, issues,
+    // Dokploy runs an application as a Swarm service named after its appName.
+    ...(appName ? { runtime: { kind: 'swarm-service' as const, name: appName } } : {}),
+  };
+}
+
+async function composeItem(get: SourceGet, id: string): Promise<PlanService> {
+  const row = ((await get(q('compose.one', { composeId: id }))) ?? {}) as Obj;
+  const name = str(row['name']) ?? str(row['appName']) ?? id;
+  const issues: PlanIssue[] = [];
+  const create: PlanService['create'] = { name, type: 'compose' };
+  if (str(row['sourceType']) === 'raw') {
+    issues.push({ level: 'manual', option: 'composeFile', detail: 'An inline compose file: paste it into a new compose service (the plan does not copy file contents).' });
+  } else {
+    Object.assign(create, repoOf(row, issues));
+    issues.push({ level: 'info', option: 'composePath', detail: `Compose file ${str(row['composePath']) ?? './docker-compose.yml'} in the repository.` });
+  }
+  if (str(row['composeType']) === 'stack') issues.push({ level: 'info', option: 'composeType', detail: 'A Swarm stack; NineDeploy runs it as a Compose stack unless you choose Swarm.' });
+  const domains = list(row['domains']).map((d) => planDomain(str(d['host']) ?? '', d['https'] === true)).filter((d) => d.host);
+  return { ref: id, name, kind: 'compose', create, domains, env: envNames(str(row['env'])), volumes: volumesOf(row['mounts']), issues };
+}
+
+const DB_KINDS: Array<{ key: string; idField: string; procedure: string; engine: PlanEngine | null }> = [
+  { key: 'postgres', idField: 'postgresId', procedure: 'postgres.one', engine: 'postgres' },
+  { key: 'mysql', idField: 'mysqlId', procedure: 'mysql.one', engine: 'mysql' },
+  { key: 'mariadb', idField: 'mariadbId', procedure: 'mariadb.one', engine: 'mariadb' },
+  { key: 'mongo', idField: 'mongoId', procedure: 'mongo.one', engine: 'mongo' },
+  { key: 'redis', idField: 'redisId', procedure: 'redis.one', engine: 'redis' },
+  { key: 'libsql', idField: 'libsqlId', procedure: 'libsql.one', engine: null },
+];
+
+export async function planFromDokploy(get: SourceGet, url: string): Promise<ImportPlan> {
+  const version = await get('/api/settings.getDokployVersion').then((v) => (typeof v === 'string' ? v.trim() : null), () => null);
+  const plan = emptyPlan('dokploy', url, version, "the organization the API key belongs to (other organizations are not read)");
+  for (const project of list(await get('/api/project.all'))) {
+    for (const env of list(project['environments'])) {
+      for (const a of list(env['applications'])) if (str(a['applicationId'])) plan.services.push(await applicationItem(get, String(a['applicationId'])));
+      for (const c of list(env['compose'])) if (str(c['composeId'])) plan.services.push(await composeItem(get, String(c['composeId'])));
+      for (const kind of DB_KINDS) {
+        for (const d of list(env[kind.key])) {
+          const id = str(d[kind.idField]);
+          if (!id) continue;
+          const row = ((await get(q(kind.procedure, { [kind.idField]: id }))) ?? {}) as Obj;
+          const issues: PlanIssue[] = kind.engine
+            ? [DATA_NOT_MOVED]
+            : [{ level: 'unsupported', option: 'libsql', detail: 'libSQL has no managed NineDeploy equivalent.' }];
+          if (row['externalPort'] != null) issues.push({ level: 'manual', option: 'externalPort', detail: 'Public access was on; turn on public access in NineDeploy if you still need it.' });
+          const item: PlanDatabase = { ref: id, name: str(row['name']) ?? str(d['name']) ?? id, engine: kind.engine, image: str(row['dockerImage']) ?? null, issues };
+          // Dokploy runs each database as a Swarm service named after its appName.
+          const appName = str(row['appName']) ?? str(d['appName']);
+          if (appName) item.runtime = { kind: 'swarm-service', name: appName };
+          plan.databases.push(item);
+        }
+      }
+    }
+  }
+  return plan;
+}

package/src/lib/importers/heroku.ts

@@ -0,0 +1,168 @@
+/**
+ * A1: an import plan from a Heroku app's own files: `app.json` and the
+ * `Procfile` in a checkout of its repository. No Heroku API and no
+ * credential: the mapping follows Heroku's documented formats
+ * (devcenter: app-json-schema, procfile).
+ *
+ * - Every Procfile process except `release` becomes a service built from the
+ *   repository with Nixpacks, whose start command is that process's line.
+ *   Nixpacks is the build pack that honours a per-service start command, runs
+ *   it through a shell (so `$PORT` expands) and sets PORT to the service port
+ *   (checked live on a NineDeploy panel; the heroku/paketo buildpacks and
+ *   Dockerfile builds ignore the start command).
+ * - A process other than `web` gets the `running` health check (it answers
+ *   no HTTP), no port routing and no domain.
+ * - `release` is not mapped to NineDeploy's pre-deploy hook, which runs in
+ *   the panel's own container before the build, without a shell (checked
+ *   live). Nixpacks itself runs the Procfile's release line as a build step
+ *   of every service built from the repository, with the attached
+ *   DATABASE_URL (checked live), so it is flagged with what that means.
+ * - Nixpacks reads the Procfile itself, as YAML: a line with `: ` inside its
+ *   command fails the build (checked live), so such lines are flagged.
+ * - `heroku-postgresql` and `heroku-redis` add-ons become databases attached
+ *   to every service under DATABASE_URL / REDIS_URL, as Heroku sets them.
+ * - Config var names come from app.json `env`; values only ever come from a
+ *   .env file at apply time (`heroku config --shell`).
+ */
+import { type ImportPlan, type PlanDatabase, type PlanEngine, type PlanIssue, type PlanService, emptyPlan } from './plan.js';
+import { isPlainName } from './shell.js';
+
+type Obj = Record<string, unknown>;
+const obj = (v: unknown): Obj => (v && typeof v === 'object' && !Array.isArray(v) ? (v as Obj) : {});
+const str = (v: unknown): string | undefined => (typeof v === 'string' && v.trim() ? v.trim() : undefined);
+
+export interface HerokuFiles {
+  /** app.json content, if the repository has one. */
+  appJson?: string;
+  /** Procfile content, if the repository has one. */
+  procfile?: string;
+  /** The repository has a heroku.yml (container builds). */
+  herokuYml?: boolean;
+}
+export interface HerokuOptions {
+  repoUrl: string;
+  branch: string;
+  /** The Heroku app name, for the pg:backups command (optional). */
+  app?: string;
+  /** Fallback service name (the checkout's directory name). */
+  dirName: string;
+}
+
+/** Procfile process types in file order: `<type>: <command>` lines. */
+export function parseProcfile(content: string): Array<{ type: string; command: string }> {
+  const out: Array<{ type: string; command: string }> = [];
+  for (const line of content.split(/\r?\n/)) {
+    const m = /^([A-Za-z0-9_-]+):\s*(.+?)\s*$/.exec(line);
+    if (m && !out.some((p) => p.type === m[1])) out.push({ type: m[1]!, command: m[2]! });
+  }
+  return out;
+}
+
+/** Add-ons NineDeploy runs itself, and the variable Heroku sets for each. */
+const ADDONS: Record<string, { engine: PlanEngine; env: string }> = {
+  'heroku-postgresql': { engine: 'postgres', env: 'DATABASE_URL' },
+  'heroku-redis': { engine: 'redis', env: 'REDIS_URL' },
+};
+
+const slugName = (s: string): string => s.toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 60) || 'app';
+
+export function planFromHeroku(files: HerokuFiles, opts: HerokuOptions): ImportPlan {
+  if (files.appJson === undefined && files.procfile === undefined) {
+    throw new Error('Neither app.json nor a Procfile was found: point --dir at a checkout of the Heroku app\'s repository.');
+  }
+  let app: Obj = {};
+  if (files.appJson !== undefined) {
+    try {
+      app = obj(JSON.parse(files.appJson));
+    } catch {
+      throw new Error('app.json is not valid JSON.');
+    }
+  }
+  const base = slugName(str(app['name']) ?? opts.dirName);
+  const herokuApp = opts.app && isPlainName(opts.app) ? opts.app : undefined;
+  const plan = emptyPlan('heroku', opts.repoUrl, null, `the app.json and Procfile of ${opts.repoUrl}@${opts.branch}`);
+  plan.notes.push('Heroku mapping: it follows Heroku\'s documented app.json and Procfile formats; no Heroku API is read.');
+
+  // Add-ons → databases.
+  const shared: PlanIssue[] = [];
+  const attachments: Array<{ database: string; envAlias: string }> = [];
+  for (const raw of Array.isArray(app['addons']) ? app['addons'] : []) {
+    const plan_ = typeof raw === 'string' ? raw : str(obj(raw)['plan']);
+    if (!plan_) continue;
+    const service = plan_.split(':')[0]!;
+    const known = ADDONS[service];
+    if (!known) {
+      shared.push({ level: 'unsupported', option: 'addon', detail: `${plan_} has no NineDeploy equivalent; run it elsewhere and set its variables by hand.` });
+      continue;
+    }
+    if (plan.databases.some((d) => d.engine === known.engine)) continue;
+    const ref = `${base}-${known.engine}`;
+    const issues: PlanIssue[] = [
+      { level: 'manual', option: 'data', detail: 'Data is not moved by this step: create the database, then restore a dump into it (step 3).' },
+    ];
+    if (known.engine === 'postgres') {
+      issues.push({ level: 'manual', option: 'ssl', detail: 'Heroku Postgres requires SSL, so apps often force it in code (sslmode=require, ssl_require=True). The NineDeploy database is reached over the internal Docker network, which has no TLS: drop that requirement for this connection.' });
+    }
+    const db: PlanDatabase = { ref, name: ref, engine: known.engine, image: null, issues };
+    if (herokuApp) db.runtime = { kind: 'heroku-app', name: herokuApp };
+    plan.databases.push(db);
+    attachments.push({ database: ref, envAlias: known.env });
+  }
+  if (plan.databases.length && !herokuApp) {
+    shared.push({ level: 'info', option: 'app', detail: 'Pass --app <heroku app name> to get a ready pg:backups command in import data.' });
+  }
+
+  // Config vars → names.
+  const env: PlanService['env'] = [];
+  for (const [key, v] of Object.entries(obj(app['env']))) {
+    if (attachments.some((a) => a.envAlias === key)) continue;
+    env.push({ key });
+    if (obj(v)['generator'] === 'secret') shared.push({ level: 'manual', option: 'env', detail: `${key} is generated on Heroku (generator: secret): put its current value in the .env file, or a new random one.` });
+  }
+
+  // Build notes.
+  const buildpacks = Array.isArray(app['buildpacks']) ? app['buildpacks'].map((b) => str(obj(b)['url']) ?? '').filter(Boolean) : [];
+  if (buildpacks.length) {
+    shared.push({ level: 'info', option: 'buildpacks', detail: `Built with Nixpacks, which detects the language itself; ${buildpacks.join(', ')} ${buildpacks.length === 1 ? 'is' : 'are'} not used. Add a nixpacks.toml if detection differs.` });
+  }
+  if (files.herokuYml) shared.push({ level: 'manual', option: 'heroku.yml', detail: 'heroku.yml builds a container: set the build pack to Dockerfile and its path under Service → Settings.' });
+  if (str(obj(app['scripts'])['postdeploy'])) {
+    shared.push({ level: 'manual', option: 'postdeploy', detail: 'scripts.postdeploy runs once on Heroku after the app is created: run it by hand after the first deploy (it is not a per-deploy hook).' });
+  }
+
+  const formation = obj(app['formation']);
+  const procs = files.procfile !== undefined ? parseProcfile(files.procfile) : [];
+  const release = procs.find((p) => p.type === 'release');
+  const runnable = procs.filter((p) => p.type !== 'release');
+  if (runnable.length === 0) runnable.push({ type: 'web', command: '' });
+  for (const p of runnable) {
+    const isWeb = p.type === 'web';
+    const name = isWeb ? base : `${base}-${slugName(p.type)}`;
+    const issues: PlanIssue[] = [...shared];
+    const create: PlanService['create'] = {
+      name, type: 'docker', repoUrl: opts.repoUrl, branch: opts.branch,
+      build: { buildPack: 'nixpacks', ...(p.command ? { startCmd: p.command } : {}) },
+    };
+    if (isWeb) {
+      create.port = 5000;
+      issues.push({ level: 'info', option: 'PORT', detail: 'NineDeploy sets PORT to the service port (5000) for a Nixpacks build, as Heroku sets $PORT.' });
+      if (release) {
+        issues.push({ level: 'manual', option: 'release', detail: `Nixpacks runs the Procfile's release line ("${release.command}") as a build step of every service built from this repository, with the attached DATABASE_URL, so it runs before each deploy of each of them, not once. Make sure that is safe (a migration usually is), or take it out of the Procfile and run it by hand. A $VARIABLE in it is built into the image with its value (the deploy log masks secret values).` });
+      }
+    }
+    if (!p.command) issues.push({ level: 'info', option: 'Procfile', detail: 'No Procfile: Nixpacks picks the start command.' });
+    if (/: /.test(p.command)) issues.push({ level: 'manual', option: 'Procfile', detail: 'Nixpacks reads the Procfile as YAML, and ": " inside this command breaks it: quote the command in the Procfile, or the build fails.' });
+    const q = Number(obj(formation[p.type])['quantity']);
+    if (Number.isInteger(q) && q > 1) create.replicas = Math.min(q, 10);
+    if (Number.isInteger(q) && q > 10) issues.push({ level: 'manual', option: 'formation', detail: `${q} dynos; NineDeploy runs at most 10 replicas of a service.` });
+    if (Number.isInteger(q) && q === 0) issues.push({ level: 'info', option: 'formation', detail: 'Scaled to 0 on Heroku; NineDeploy runs one when it deploys the service.' });
+    const size = str(obj(formation[p.type])['size']);
+    if (size) issues.push({ level: 'info', option: 'size', detail: `Dyno size ${size}: set a memory limit under Service → Settings if you need one.` });
+    const svc: PlanService = { ref: p.type, name, kind: 'git', create, domains: [], env: [...env], volumes: [], issues };
+    if (!isWeb) svc.settings = { healthCheck: 'running' };
+    if (attachments.length) svc.attachments = attachments.map((a) => ({ ...a }));
+    plan.services.push(svc);
+  }
+  plan.notes.push('Domains are not in app.json: add them with import cutover after editing the plan, or under Service → Domains.');
+  return plan;
+}