openmates 0.12.0-alpha.28 → 0.12.0-alpha.29

package/dist/{chunk-TTQIZ476.js → chunk-FCSXUBOU.js}

@@ -8964,7 +8964,7 @@ function formatTs(ts) {
 }
 
 // src/server.ts
-import { execSync, spawn as nodeSpawn } from "child_process";
+import { execFileSync as execFileSync2, execSync, spawn as nodeSpawn } from "child_process";
 import { createHash as createHash6, randomBytes as randomBytes2 } from "crypto";
 import { chmodSync as chmodSync2, copyFileSync, cpSync, existsSync as existsSync5, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync5, readdirSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
 import { createInterface as createInterface2 } from "readline";
@@ -9104,6 +9104,49 @@ function planRestore(input) {
     steps: input.yes === true ? ["stop", "restore", "start", "health-check"] : ["confirm", "stop", "restore", "start", "health-check"]
   };
 }
+function parseSecretEnvKey(envKey) {
+  if (!envKey.startsWith("SECRET__")) return null;
+  const parts = envKey.slice("SECRET__".length).split("__", 2);
+  if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
+  return {
+    envKey,
+    vaultPath: `kv/data/providers/${parts[0].toLowerCase()}`,
+    vaultKey: parts[1].toLowerCase()
+  };
+}
+function summarizeSecretPreflight(input) {
+  const inlineSecretEnvKeys = [];
+  const importedSecretEnvKeys = [];
+  const emptySecretEnvKeys = [];
+  const importedVaultPresent = [];
+  const importedVaultMissing = [];
+  const importedVaultUnavailable = [];
+  for (const [envKey, rawValue] of Object.entries(input.env).sort(([a], [b]) => a.localeCompare(b))) {
+    if (!parseSecretEnvKey(envKey)) continue;
+    const value = rawValue.trim();
+    if (!value) {
+      emptySecretEnvKeys.push(envKey);
+      continue;
+    }
+    if (value !== "IMPORTED_TO_VAULT") {
+      inlineSecretEnvKeys.push(envKey);
+      continue;
+    }
+    importedSecretEnvKeys.push(envKey);
+    const presence = input.vaultPresence?.[envKey];
+    if (presence === "present") importedVaultPresent.push(envKey);
+    else if (presence === "missing") importedVaultMissing.push(envKey);
+    else importedVaultUnavailable.push(envKey);
+  }
+  return {
+    inlineSecretEnvKeys,
+    importedSecretEnvKeys,
+    emptySecretEnvKeys,
+    importedVaultPresent,
+    importedVaultMissing,
+    importedVaultUnavailable
+  };
+}
 function planCaddyCommand(input) {
   const role = parseServerRole(input.role);
   const templatePath = `templates/caddy/${role}/Caddyfile`;
@@ -9796,6 +9839,89 @@ function missingRequiredEnvKeys(installPath, role) {
   const env = readEnvMap(installPath);
   return requiredRuntimeEnvKeys(role).filter((key) => !env[key]);
 }
+function vaultCheckContainerForRole(role) {
+  if (role === "core") return "api";
+  if (role === "upload") return "app-uploads";
+  return null;
+}
+function readImportedVaultSecretPresence(role, importedSecrets) {
+  const checks = importedSecrets.filter((item) => item !== null);
+  if (checks.length === 0) return { presence: {}, checked: true, unavailableReason: null };
+  const container = vaultCheckContainerForRole(role);
+  if (!container) {
+    return { presence: {}, checked: false, unavailableReason: `${role} role does not expose a Vault-backed app container for secret verification.` };
+  }
+  const script = `
+import json
+import os
+import urllib.error
+import urllib.request
+
+checks = json.loads(os.environ["OPENMATES_SECRET_CHECKS"])
+token_path = "/vault-data/api.token"
+try:
+    with open(token_path, "r", encoding="utf-8") as token_file:
+        token = token_file.read().strip()
+except Exception as exc:
+    print(json.dumps({"ok": False, "reason": f"could not read {token_path}: {exc}", "presence": {}}))
+    raise SystemExit(0)
+
+presence = {}
+for item in checks:
+    request = urllib.request.Request(
+        f"http://vault:8200/v1/{item['vaultPath']}",
+        headers={"X-Vault-Token": token},
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=3) as response:
+            payload = json.loads(response.read().decode("utf-8"))
+        value = payload.get("data", {}).get("data", {}).get(item["vaultKey"])
+        presence[item["envKey"]] = "present" if value else "missing"
+    except urllib.error.HTTPError as exc:
+        presence[item["envKey"]] = "missing" if exc.code == 404 else "unavailable"
+    except Exception:
+        presence[item["envKey"]] = "unavailable"
+
+print(json.dumps({"ok": True, "presence": presence}))
+`;
+  try {
+    const output = execFileSync2(
+      "docker",
+      ["exec", "-e", `OPENMATES_SECRET_CHECKS=${JSON.stringify(checks)}`, container, "python", "-c", script],
+      { encoding: "utf-8", timeout: 1e4, stdio: ["pipe", "pipe", "pipe"] }
+    ).trim();
+    const parsed = JSON.parse(output);
+    if (parsed.ok === false) return { presence: {}, checked: false, unavailableReason: parsed.reason ?? "Vault check failed." };
+    return { presence: parsed.presence ?? {}, checked: true, unavailableReason: null };
+  } catch (error) {
+    return {
+      presence: {},
+      checked: false,
+      unavailableReason: `Vault check unavailable. Is the ${container} container running? ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+function runtimeSecretPreflight(installPath, role) {
+  const env = readEnvMap(installPath);
+  const importedSecrets = Object.entries(env).filter(([, value]) => value.trim() === "IMPORTED_TO_VAULT").map(([envKey]) => parseSecretEnvKey(envKey)).filter((item) => item !== null);
+  const vault = readImportedVaultSecretPresence(role, importedSecrets);
+  return {
+    ...summarizeSecretPreflight({ env, vaultPresence: vault.presence }),
+    vaultChecked: vault.checked,
+    vaultUnavailableReason: vault.unavailableReason
+  };
+}
+function formatSecretPreflight(preflight) {
+  const parts = [
+    `${preflight.importedVaultPresent.length}/${preflight.importedSecretEnvKeys.length} imported verified`
+  ];
+  if (preflight.importedVaultMissing.length) parts.push(`missing in Vault: ${preflight.importedVaultMissing.join(", ")}`);
+  if (preflight.importedVaultUnavailable.length) parts.push(`unverified: ${preflight.importedVaultUnavailable.join(", ")}`);
+  if (preflight.inlineSecretEnvKeys.length) parts.push(`inline SECRET entries: ${preflight.inlineSecretEnvKeys.length}`);
+  if (preflight.emptySecretEnvKeys.length) parts.push(`empty SECRET entries: ${preflight.emptySecretEnvKeys.length}`);
+  if (preflight.vaultUnavailableReason) parts.push(preflight.vaultUnavailableReason);
+  return parts.join("; ");
+}
 function writeChecksums(rootDir) {
   const lines = [];
   const walk = (dir) => {
@@ -10339,6 +10465,12 @@ async function serverUpdate(rest, flags) {
   const filterRequested = hasServiceFilter(flags);
   const selectedServices = filterRequested ? selectedComposeServices(role, flags) : [];
   const missingEnvKeys = missingRequiredEnvKeys(installPath, role);
+  const secretPreflight = runtimeSecretPreflight(installPath, role);
+  const missingOrUnverifiedSecrets = [
+    ...missingEnvKeys,
+    ...secretPreflight.importedVaultMissing,
+    ...secretPreflight.importedVaultUnavailable
+  ];
   if (installMode === "source" && (flags["image-tag"] !== void 0 || flags.channel !== void 0)) {
     throw new Error("--image-tag and --channel only apply to image-mode installs. Source-mode installs update from Git.");
   }
@@ -10348,7 +10480,7 @@ async function serverUpdate(rest, flags) {
     const currentTag = getImageTagFromEnv(installPath, config);
     const target = resolveTargetImageTag(flags, currentTag, getPackageVersion());
     const templateRef = templateRefForImageTag(target.tag, getPackageVersion());
-    const safetyPlan = planUpdate({ role, selectedServices, dryRun, skipBackup: flags["skip-backup"] === true, continuous: false, missingRequiredSecrets: missingEnvKeys });
+    const safetyPlan = planUpdate({ role, selectedServices, dryRun, skipBackup: flags["skip-backup"] === true, continuous: false, missingRequiredSecrets: missingOrUnverifiedSecrets });
     const plan = {
       command: "update",
       role,
@@ -10362,6 +10494,7 @@ async function serverUpdate(rest, flags) {
       steps: safetyPlan.steps,
       backupName: safetyPlan.backupName,
       missingRequiredEnvKeys: missingEnvKeys,
+      secretPreflight,
       blocked: safetyPlan.blocked,
       blockReason: safetyPlan.blockReason,
       dryRun
@@ -10380,13 +10513,16 @@ async function serverUpdate(rest, flags) {
         console.log(`  Backup:        ${safetyPlan.backupName ?? "none"}`);
         console.log(`  Steps:         ${safetyPlan.steps.join(" -> ")}`);
         console.log(`  Env preflight: ${missingEnvKeys.length ? `missing ${missingEnvKeys.join(", ")}` : "ok"}`);
+        console.log(`  Vault secrets: ${formatSecretPreflight(secretPreflight)}`);
         console.log("  Commands:      refresh compose, docker compose pull, docker compose up -d, health checks");
       }
       return;
     }
     if (safetyPlan.blocked) throw new Error(safetyPlan.blockReason ?? "Update blocked by preflight.");
-    if (missingEnvKeys.length && flags.yes !== true) {
-      throw new Error(`Required environment keys are missing: ${missingEnvKeys.join(", ")}. Add them to .env or rerun with --yes after reviewing.`);
+    if (missingOrUnverifiedSecrets.length && flags.yes !== true) {
+      throw new Error(
+        `Required runtime secret checks failed: ${missingOrUnverifiedSecrets.join(", ")}. Add missing non-SECRET values to .env, ensure IMPORTED_TO_VAULT markers exist in Vault, or rerun with --yes after reviewing.`
+      );
     }
     console.error(`Mode: image`);
     console.error(`Current image tag: ${currentTag || "unknown"}`);
@@ -10939,8 +11075,14 @@ async function serverPreflight(flags) {
   const config = loadConfigForInstallPath(installPath);
   const role = getServerRole(flags, config);
   const services = hasServiceFilter(flags) ? selectedComposeServices(role, flags) : [];
-  const updatePlan = planUpdate({ role, selectedServices: services, dryRun: true });
   const missingEnvKeys = missingRequiredEnvKeys(installPath, role);
+  const secretPreflight = runtimeSecretPreflight(installPath, role);
+  const missingOrUnverifiedSecrets = [
+    ...missingEnvKeys,
+    ...secretPreflight.importedVaultMissing,
+    ...secretPreflight.importedVaultUnavailable
+  ];
+  const updatePlan = planUpdate({ role, selectedServices: services, dryRun: true, continuous: true, missingRequiredSecrets: missingOrUnverifiedSecrets });
   const runtimePlan = planServerRuntime({
     role,
     profile: getCoreProfile(flags, config),
@@ -10958,6 +11100,10 @@ async function serverPreflight(flags) {
     updateSteps: updatePlan.steps,
     backupName: updatePlan.backupName,
     missingRequiredEnvKeys: missingEnvKeys,
+    secretPreflight,
+    missingOrUnverifiedSecrets,
+    blocked: updatePlan.blocked,
+    blockReason: updatePlan.blockReason,
     caddy: caddyPlan
   };
   if (flags.json === true) {
@@ -10970,6 +11116,8 @@ async function serverPreflight(flags) {
   console.log(`  Services:      ${hasServiceFilter(flags) ? services.join(", ") : "all"}`);
   console.log(`  Backup:        ${updatePlan.backupName ?? "none"}`);
   console.log(`  Env preflight: ${missingEnvKeys.length ? `missing ${missingEnvKeys.join(", ")}` : "ok"}`);
+  console.log(`  Vault secrets: ${formatSecretPreflight(secretPreflight)}`);
+  if (updatePlan.blocked) console.log(`  Blocked:       ${updatePlan.blockReason}`);
   console.log(`  Health checks: ${runtimePlan.healthChecks.join(", ")}`);
   console.log(`  Caddy steps:   ${caddyPlan.steps.join(" -> ")}`);
 }
@@ -11022,14 +11170,16 @@ WARNING: This will replace ${appliedPath} with the packaged ${role} Caddyfile.`)
       }
     }
     const backupPath = `${appliedPath}.openmates-backup-${nowStamp()}`;
+    const hadExistingCaddyfile = existsSync5(appliedPath);
     try {
-      if (existsSync5(appliedPath)) copyFileSync(appliedPath, backupPath);
+      mkdirSync3(dirname(appliedPath), { recursive: true });
+      if (hadExistingCaddyfile) copyFileSync(appliedPath, backupPath);
       copyFileSync(templatePath, appliedPath);
       execSync("systemctl reload caddy", { stdio: "inherit" });
     } catch (error) {
       throw new Error(`Could not apply Caddyfile. Run with sudo or use --config <writable path>. ${error instanceof Error ? error.message : String(error)}`);
     }
-    console.log(`Applied Caddyfile for ${role}. Backup: ${backupPath}`);
+    console.log(`Applied Caddyfile for ${role}. ${hadExistingCaddyfile ? `Backup: ${backupPath}` : "No previous Caddyfile existed."}`);
     return;
   }
   console.log(`Caddy ${action} plan:`);
@@ -25307,7 +25457,8 @@ version_number: 1`,
   ],
   metadata: {
     featured: true,
-    order: 105
+    order: 105,
+    content_embed_examples: ["mindmaps.mindmap"]
   }
 };
 
@@ -28033,6 +28184,12 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
       continue: {
         text: "Continue"
       },
+      skip: {
+        text: "Skip"
+      },
+      select_interests: {
+        text: "Select interests"
+      },
       software_development: {
         text: "software development"
       },

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   getExtForLang,
   serializeToYaml
-} from "./chunk-TTQIZ476.js";
+} from "./chunk-FCSXUBOU.js";
 import "./chunk-AXNRPVLE.js";
 export {
   getExtForLang,

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   getExtForLang,
   normalizeInterestTagIds,
   serializeToYaml
-} from "./chunk-TTQIZ476.js";
+} from "./chunk-FCSXUBOU.js";
 import "./chunk-AXNRPVLE.js";
 export {
   ASSISTANT_FEEDBACK_REPORT_TITLE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.12.0-alpha.28",
+  "version": "0.12.0-alpha.29",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",