@geekmidas/cli 10.0.0-alpha.103 → 10.0.0-alpha.105

package/dist/{seeds-Cx8NmuQj.mjs → seeds-BfzwCdYv.mjs}

@@ -3,12 +3,12 @@ import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, ct as UnknownSecretsStoreProvider, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, j as TEST_STAGE, pt as SERVER_IPV6_KEY, ut as s3SecretsLocation, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-D1QbNd55.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { a as DEFAULT_CACHE, c as holdsEveryCache, i as readFakes, o as DEFAULT_EVENTS$1, r as readCredentialFakes, s as DEFAULT_STORAGE, t as SubscriberGenerator } from "./SubscriberGenerator-YK-7ewmi.mjs";
+import { a as DEFAULT_CACHE, c as holdsEveryCache, i as readFakes, o as DEFAULT_EVENTS$1, r as readCredentialFakes, s as DEFAULT_STORAGE, t as SubscriberGenerator } from "./SubscriberGenerator-DHnIYwUU.mjs";
 import { n as deployIdentity } from "./identity-CBXr4wNi.mjs";
-import { a as startTelemetryCode, n as runtimeFor, s as writeTelemetryModule, u as telemetryArgs } from "./EndpointGenerator-Br97xgs_.mjs";
-import { d as output, r as discover, u as ConstructGenerator } from "./discover-kziEht4W.mjs";
+import { a as startTelemetryCode, n as runtimeFor, s as writeTelemetryModule, u as telemetryArgs } from "./EndpointGenerator-CvLX8bpx.mjs";
+import { d as ConstructGenerator, f as output, i as discover } from "./discover-Ca8U75dl.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { c as runtimeOf } from "./resolve-BGgwxfCz.mjs";
+import { c as runtimeOf } from "./resolve-DCdFajey.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -16,7 +16,7 @@ import { homedir, hostname, networkInterfaces, userInfo } from "node:os";
 import { execFile, spawn } from "node:child_process";
 import { createServer } from "node:net";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt } from "node:crypto";
-import { CLIENT_IP_HEADER, DEFAULT_POSTGRES_VERSION, TELEMETRY_KEYS, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase } from "@geekmidas/manifest";
+import { CLIENT_IP_HEADER, DEFAULT_POSTGRES_VERSION, TELEMETRY_KEYS, cacheTable, cookieDomain, dependenciesOf, dependentsOf, drawSecret, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase } from "@geekmidas/manifest";
 import { formatKeyring, generateKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import * as snsUrl from "@geekmidas/events/sns/url";
@@ -724,10 +724,8 @@ function emulatorQueueUrl(name, port) {
 * Which processes use a `Telemetry` node — read off the manifest's edges.
 *
 * A process uses telemetry when its own declaration names the node: a
-* surface's `telemetry`, a worker's. The server the build generates for a
-* surface whose endpoints a glob finds also runs the workers' crons and
-* consumers under `gkm dev`, and is handed their edges' keys by `appEnvKeys`,
-* so a worker's edge counts for it too — the same rule, read the same way.
+* surface's `telemetry`, a worker's. A surface's process runs its own
+* endpoints, so a worker's edge never counts for it.
 *
 * A site's edge is recorded and never followed here: a site is handed none of
 * the node's keys (see `PUBLIC.telemetry`).
@@ -753,14 +751,7 @@ function telemetryOf(manifest, id) {
 	if (!declaration) return void 0;
 	if (declaration.kind === "worker") return nodeOf(manifest, declaration.telemetry);
 	if (declaration.kind !== "rest-api") return void 0;
-	const own = nodeOf(manifest, declaration.telemetry);
-	if (own) return own;
-	if (declaration.endpoints.length > 0) return void 0;
-	for (const other of Object.values(manifest)) {
-		if (other.kind !== "worker") continue;
-		const node = nodeOf(manifest, other.telemetry);
-		if (node) return node;
-	}
+	return nodeOf(manifest, declaration.telemetry);
 }
 /**
 * The `Telemetry` node the app `appName` emits through — its surface's, or
@@ -1040,6 +1031,10 @@ function planFor(manifest, stage, order, options = {}) {
 			} } : {},
 			...declaration.kind === "external-api" && !fake ? { url: declaration.url } : {},
 			...declaration.kind === "credential" && options.credentialFakes?.[id] !== void 0 ? { fakeCredentials: options.credentialFakes[id] } : {},
+			...declaration.kind === "secret" && (declaration.length !== void 0 || declaration.symbols !== void 0) ? { format: {
+				...declaration.length !== void 0 ? { length: declaration.length } : {},
+				...declaration.symbols !== void 0 ? { symbols: declaration.symbols } : {}
+			} } : {},
 			..."of" in declaration && !detached ? { of: declaration.of } : {},
 			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
 			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
@@ -1559,10 +1554,36 @@ function localKeyring(project, plan, resource) {
 * A hash of what identifies it, so it is stable, distinct per project, stage
 * and construct, and never written to disk as a literal. Deployed this is the
 * one kind whose value does *not* come from here — a secret manager generates
-* it once and the target reads it back.
+* it once and the target reads it back. Drawn in the format the deploy draws
+* it in, so a value that passes a third party's rules here passes them there.
 */
 function localSecret(project, plan, resource) {
-	return createHash("sha256").update(`${project}:${plan.stage}:${resource.id}`).digest("base64url").slice(0, 43);
+	return drawSecret(hashStream(`${project}:${plan.stage}:${resource.id}`), resource.format);
+}
+/**
+* Integers in `[0, n)` drawn from a hash of `seed`, the same every time —
+* what a local secret is drawn with instead of `crypto`, so `gkm dev` and
+* `gkm test` need nothing stored. Rejection-sampled, so no character is
+* likelier than another.
+*/
+function hashStream(seed) {
+	let block = 0;
+	let bytes = Buffer.alloc(0);
+	let offset = 0;
+	const next = () => {
+		if (offset === bytes.length) {
+			bytes = createHash("sha256").update(`${seed}:${block++}`).digest();
+			offset = 0;
+		}
+		return bytes[offset++];
+	};
+	return (n) => {
+		const limit = 256 - 256 % n;
+		for (;;) {
+			const byte = next();
+			if (byte < limit) return byte % n;
+		}
+	};
 }
 //#endregion
 //#region src/compose/redis.ts
@@ -1720,8 +1741,8 @@ function redisService(redis) {
 *   master and roles, a bucket's root user. Derived from repo facts alone
 *   (project, stage, construct id), those passwords were computable by anyone
 *   who could read the repo.
-* - **Each `secret` construct's value** — an auth server's signing secret —
-*   random, rather than derived.
+* - **Each `secret` construct's value** — an auth server's signing secret, a
+*   `RandomPassword` — random, rather than derived, in its declared format.
 * - **Each `encryption` construct's keyring** — one random key and an index
 *   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
 *
@@ -1742,7 +1763,7 @@ function withGeneratedSecrets(secrets, manifest) {
 		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
 		const key = declaration.provides?.[0];
 		if (!key || custom[key]) continue;
-		custom[key] = declaration.kind === "encryption" ? generateKeyring() : random();
+		custom[key] = declaration.kind === "encryption" ? generateKeyring() : drawSecret(randomInt, declaration);
 		generated.push(key);
 	}
 	const seed = secrets.seed ?? generateSeed();
@@ -2613,6 +2634,7 @@ function workerUnits(workspace, manifest, background) {
 	}
 	return units.sort((a, b) => a.name.localeCompare(b.name));
 }
+/** Whether `file` is inside `dir`. */
 function isUnder(file, dir) {
 	const rel = relative(dir, file);
 	return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel) ? !rel.startsWith(`..${sep}`) : false;
@@ -5545,7 +5567,7 @@ async function reconcileWorkspace(workspace, options) {
 		metroPorts: metroPorts(workspace, manifest),
 		fakes,
 		credentialFakes,
-		apps: (containers) => appServices(workspace, manifest, containers, credentials, runnables, fakes),
+		apps: (containers) => appServices(workspace, manifest, containers, credentials, runnables, fakes, credentialFakes),
 		...options.start === void 0 ? {} : { start: options.start },
 		...options.progress ? { progress: options.progress } : {}
 	});
@@ -5642,11 +5664,12 @@ function dockerfileOf(appName, path) {
 * surface resolved to its `*.localhost` host on the edge's port, which the
 * rewrite to the compose network then turned into an address nothing answers.
 */
-function localPlan(workspace, manifest, fakes = {}) {
+function localPlan(workspace, manifest, fakes = {}, credentialFakes = {}) {
 	return planFor(manifest, workspace.stages.local, provisionOrder(manifest), {
 		localStage: workspace.stages.local,
 		...backendsOf(workspace),
 		fakes,
+		credentialFakes,
 		edge: false
 	});
 }
@@ -5709,8 +5732,12 @@ function networkEnv(plan, options, hostOf = (container) => container) {
 *
 * One hop: a surface an app calls is reached over HTTP, so its URL is the
 * app's business and its database is not. A site also gets the public
-* variant of each key its bundle inlines (`NEXT_PUBLIC_API_URL`), and a surface
-* the edges of the workers whose crons and subscribers its server runs.
+* variant of each key its bundle inlines (`NEXT_PUBLIC_API_URL`).
+*
+* A surface's process runs its own endpoints and nothing else. A Worker's
+* crons, queue consumers and subscribers run in the worker's own process
+* (`workerEnvKeys`), so no surface is handed a worker's edges — however its
+* endpoints were found.
 *
 * `undefined` for an app no declaration describes, which gets nothing but its
 * port.
@@ -5724,20 +5751,7 @@ function appEnvKeys(manifest, appName, runnables = {}) {
 		...declaration.requires ?? [],
 		...declaration.kind === "rest-api" ? declaration.endpoints.flatMap((endpoint) => endpoint.requires ?? []) : []
 	]);
-	const edges = [...dependenciesOf(declaration).map((edge) => edge.target), ...runnables[id] ?? []];
-	if (declaration.kind === "rest-api" && declaration.endpoints.length === 0) {
-		const runsWorkers = Object.values(manifest).some((other) => other.kind === "worker");
-		for (const [otherId, other] of Object.entries(manifest)) {
-			if (other.kind !== "worker") continue;
-			edges.push(...dependenciesOf(other).map((edge) => edge.target), ...runnables[otherId] ?? []);
-			keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
-		}
-		if (runsWorkers) for (const other of Object.values(manifest)) {
-			if (other.kind !== "queue" && other.kind !== "topic") continue;
-			for (const key of other.provides ?? []) keys.add(key);
-		}
-	}
-	addEdgeKeys(manifest, edges, keys);
+	addEdgeKeys(manifest, [...dependenciesOf(declaration).map((edge) => edge.target), ...runnables[id] ?? []], keys);
 	if (declaration.kind === "site" || declaration.kind === "mobile-app") {
 		for (const key of TELEMETRY_KEYS) keys.delete(key);
 		for (const key of Object.keys(publicEnvFor(declaration, manifest))) keys.add(key);
@@ -5746,10 +5760,9 @@ function appEnvKeys(manifest, appName, runnables = {}) {
 }
 /**
 * The keys a Worker's own process reads: what the worker and everything built
-* from it declared an edge to, the broker its crons schedule through, and the
-* address of every queue and topic — which of them its consumers and
-* subscribers are bound to is only known once a build has found them, so a
-* process that runs them is handed each carrier's.
+* from it declared an edge to — the queues its consumers drain and the topics
+* its subscribers are bound to among them (see `DiscoverOptions.runnables`) —
+* and the broker its crons schedule through.
 *
 * `undefined` when no worker has that id.
 */
@@ -5761,10 +5774,6 @@ function workerEnvKeys(manifest, workerId, runnables = {}) {
 		...declaration.requires ?? [],
 		"EVENT_PUBLISHER_CONNECTION_STRING"
 	]);
-	for (const other of Object.values(manifest)) {
-		if (other.kind !== "queue" && other.kind !== "topic") continue;
-		for (const key of other.provides ?? []) keys.add(key);
-	}
 	addEdgeKeys(manifest, [...dependenciesOf(declaration).map((edge) => edge.target), ...runnables[workerId] ?? []], keys);
 	return keys;
 }
@@ -5788,8 +5797,8 @@ function addEdgeKeys(manifest, edges, keys) {
 	}
 }
 /** One compose service per app the workspace runs, behind the apps profile. */
-function appServices(workspace, manifest, containers, credentials, runnables = {}, fakes = {}) {
-	const plan = localPlan(workspace, manifest, fakes);
+function appServices(workspace, manifest, containers, credentials, runnables = {}, fakes = {}, credentialFakes = {}) {
+	const plan = localPlan(workspace, manifest, fakes, credentialFakes);
 	const derivation = {
 		project: workspace.name,
 		credentials,
@@ -7301,7 +7310,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await import("./GoDaddyProvider-8gNDqaml.mjs");
+		const { GoDaddyProvider } = await import("./GoDaddyProvider-DjtX8TUM.mjs");
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -8150,6 +8159,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { devServicesUsed as $, applyBuckets as $t, assertStageProvidersEnabled as A, scopeTelemetryEnv as An, isPortAvailable as At, workerDockerfileOf as B, portsOf as Bn, maskPassword as Bt, setApplicationId as C, envFor as Cn, cacheBackendFor as Ct, DnsRecordsUnreadable as D, resourceName as Dn, createCredentialsPreload as Dt, setPostgresBackupId as E, planFor as En, storageBackendFor as Et, DockerPushFailed as F, hostFor as Fn, isRemoteStore as Ft, CronGenerator as G, logsAccess as Gn, imageLayout as Gt, workerBundleName as H, primaryPortKey as Hn, toEmbeddableSecrets as Ht, appDockerfile as I, DEFAULT_IMAGES as In, secretsStoreFor as It, DEV_SERVICES as J, withLogsPassword as Jn, detectPackageManager as Jt, validateImageRef as K, logsService as Kn, TURBO_VERSION as Kt, dockerCommand as L, describeServices as Ln, storeFromConfig as Lt, stageProviderNotes as M, telemetryOf as Mn, loadPortState as Mt, PROVIDER_KINDS as N, usesTelemetry as Nn, loadSecretsForApp as Nt, createDnsProvider as O, appTelemetry as On, createEntryWrapper as Ot, DockerBuildFailed as P, EMULATOR_ACCESS_KEY_ID as Pn, prepareEntryCredentials as Pt, assertDevServicesFlag as Q, workerUnits as Qt, ensureDockerignore as R, fakeKey as Rn, store_exports as Rt, recordRollback as S, withRedisPassword as Sn, composeFor as St, setGeneratedSecret as T, TELEMETRY_CONTAINER as Tn, providerOf as Tt, workerEntryDir as U, LOCAL_LOGS_EMAIL as Un, withCustomSecret as Ut, WorkerGenerator as V, postgresImage as Vn, storage_exports as Vt, QueueGenerator as W, LOGS_SERVICE as Wn, composeBuildPaths as Wt, ExternalServicesNotConfigured as X, isMainFrontendApp as Xn, imageBuildCredentials as Xt, DevServicesNeedServerTarget as Y, NoDomainForStage as Yn, findBuildRoot as Yt, STORAGE_KEY_PAIR as Z, resolveHost as Zn, isImageBuild as Zt, createComposeState as _, REDIS_SERVICE as _n, LEGACY_LOCAL_LOGIN as _t, dnsResources as a, quoteIdentifier as an, appEnvKeys as at, getGeneratedSecret as b, runsRedis as bn, pgClient as bt, describeActor as c, postgresRoleSlug as cn, workerEnvKeys as ct, extractSubdomain as d, FileSecretsStore as dn, constructGlobs as dt, applyPolicies as en, externalServices as et, findRootDomain as f, getKeyPath as fn, derivedContainers as ft, asDokployState as g, withGeneratedSecrets as gn, forgetState as gt, verifyDnsRecords as h, readKey as hn, LOCAL_CA_PATH as ht, dnsRecordResource as i, postgresStatements as in, suppliedOnly as it, provisionCommand as j, surfaceClientTraced as jn, loadEnvFiles as jt, StageProviderDisabled as k, isTelemetryKey as kn, findAvailablePort as kt, isCi as l, postgresSuperuser as ln, FAKE_ENV as lt, orchestrateDns as m, projectKey as mn, workspace_exports as mt, reportDatabaseRuns as n, bucketPolicies as nn, requiredStageKeys as nt, recordDnsChanges as o, LOCAL_RABBITMQ_USER as on, dockerfileOf as ot, normalizeDnsConfig as p, keystoreProject as pn, reconcileWorkspace as pt, AllowDevServicesTakesNoValue as q, stackLogs as qn, WORKER_PORT as qt, reportPlannedSeeds as r, postgresDatabaseNames as rn, stageServiceDeclarations as rt, currentActor as s, loadLocalCredentials as sn, networkEnv as st, DeploySeedsFailed as t, applyPostgres as tn, reportDevServices as tt, DeployJournal as u, readLocalCredentials as un, backendsOf as ut, createEmptyState as v, STACK_CACHE as vn, ensurePostgresLogin as vt, setBackupState as w, localRolePassword as wn, eventsBackendFor as wt, recordRelease as x, stackRedis as xn, CLUSTER_DATABASE as xt, getBackupState as y, redisService as yn, bucketClient as yt, workerDockerfile as z, portKeys as zn, initStageSecrets as zt };
+export { devServicesUsed as $, workerUnits as $t, assertStageProvidersEnabled as A, isTelemetryKey as An, isPortAvailable as At, workerDockerfileOf as B, portKeys as Bn, maskPassword as Bt, setApplicationId as C, withRedisPassword as Cn, cacheBackendFor as Ct, DnsRecordsUnreadable as D, planFor as Dn, createCredentialsPreload as Dt, setPostgresBackupId as E, TELEMETRY_CONTAINER as En, storageBackendFor as Et, DockerPushFailed as F, EMULATOR_ACCESS_KEY_ID as Fn, isRemoteStore as Ft, CronGenerator as G, LOGS_SERVICE as Gn, imageLayout as Gt, workerBundleName as H, postgresImage as Hn, toEmbeddableSecrets as Ht, appDockerfile as I, hostFor as In, secretsStoreFor as It, DEV_SERVICES as J, stackLogs as Jn, detectPackageManager as Jt, validateImageRef as K, logsAccess as Kn, TURBO_VERSION as Kt, dockerCommand as L, DEFAULT_IMAGES as Ln, storeFromConfig as Lt, stageProviderNotes as M, surfaceClientTraced as Mn, loadPortState as Mt, PROVIDER_KINDS as N, telemetryOf as Nn, loadSecretsForApp as Nt, createDnsProvider as O, resourceName as On, createEntryWrapper as Ot, DockerBuildFailed as P, usesTelemetry as Pn, prepareEntryCredentials as Pt, assertDevServicesFlag as Q, resolveHost as Qn, isUnder as Qt, ensureDockerignore as R, describeServices as Rn, store_exports as Rt, recordRollback as S, stackRedis as Sn, composeFor as St, setGeneratedSecret as T, localRolePassword as Tn, providerOf as Tt, workerEntryDir as U, primaryPortKey as Un, withCustomSecret as Ut, WorkerGenerator as V, portsOf as Vn, storage_exports as Vt, QueueGenerator as W, LOCAL_LOGS_EMAIL as Wn, composeBuildPaths as Wt, ExternalServicesNotConfigured as X, NoDomainForStage as Xn, imageBuildCredentials as Xt, DevServicesNeedServerTarget as Y, withLogsPassword as Yn, findBuildRoot as Yt, STORAGE_KEY_PAIR as Z, isMainFrontendApp as Zn, isImageBuild as Zt, createComposeState as _, withGeneratedSecrets as _n, LEGACY_LOCAL_LOGIN as _t, dnsResources as a, postgresStatements as an, appEnvKeys as at, getGeneratedSecret as b, redisService as bn, pgClient as bt, describeActor as c, loadLocalCredentials as cn, workerEnvKeys as ct, extractSubdomain as d, readLocalCredentials as dn, constructGlobs as dt, applyBuckets as en, externalServices as et, findRootDomain as f, FileSecretsStore as fn, derivedContainers as ft, asDokployState as g, readKey as gn, forgetState as gt, verifyDnsRecords as h, projectKey as hn, LOCAL_CA_PATH as ht, dnsRecordResource as i, postgresDatabaseNames as in, suppliedOnly as it, provisionCommand as j, scopeTelemetryEnv as jn, loadEnvFiles as jt, StageProviderDisabled as k, appTelemetry as kn, findAvailablePort as kt, isCi as l, postgresRoleSlug as ln, FAKE_ENV as lt, orchestrateDns as m, keystoreProject as mn, workspace_exports as mt, reportDatabaseRuns as n, applyPostgres as nn, requiredStageKeys as nt, recordDnsChanges as o, quoteIdentifier as on, dockerfileOf as ot, normalizeDnsConfig as p, getKeyPath as pn, reconcileWorkspace as pt, AllowDevServicesTakesNoValue as q, logsService as qn, WORKER_PORT as qt, reportPlannedSeeds as r, bucketPolicies as rn, stageServiceDeclarations as rt, currentActor as s, LOCAL_RABBITMQ_USER as sn, networkEnv as st, DeploySeedsFailed as t, applyPolicies as tn, reportDevServices as tt, DeployJournal as u, postgresSuperuser as un, backendsOf as ut, createEmptyState as v, REDIS_SERVICE as vn, ensurePostgresLogin as vt, setBackupState as w, envFor as wn, eventsBackendFor as wt, recordRelease as x, runsRedis as xn, CLUSTER_DATABASE as xt, getBackupState as y, STACK_CACHE as yn, bucketClient as yt, workerDockerfile as z, fakeKey as zn, initStageSecrets as zt };
 
-//# sourceMappingURL=seeds-Cx8NmuQj.mjs.map
+//# sourceMappingURL=seeds-BfzwCdYv.mjs.map