@geekmidas/cli 10.0.0-alpha.103 → 10.0.0-alpha.105

package/dist/{seeds-a1H3kuqu.cjs → seeds-DkcKQ_F8.cjs}

@@ -3,12 +3,12 @@ const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_workspace = require("./workspace-BwqQnool.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-DmPM_3c5.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-CeH7wbYt.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_EndpointGenerator = require("./EndpointGenerator-By5_tYE9.cjs");
-const require_discover = require("./discover-BfhVW_kT.cjs");
+const require_EndpointGenerator = require("./EndpointGenerator-BwbYTMtB.cjs");
+const require_discover = require("./discover-Bsr7HjqJ.cjs");
 const require_config = require("./config.cjs");
-const require_resolve = require("./resolve-aqhkZfDI.cjs");
+const require_resolve = require("./resolve-CJ91HNQB.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -726,10 +726,8 @@ function emulatorQueueUrl(name, port) {
 * Which processes use a `Telemetry` node — read off the manifest's edges.
 *
 * A process uses telemetry when its own declaration names the node: a
-* surface's `telemetry`, a worker's. The server the build generates for a
-* surface whose endpoints a glob finds also runs the workers' crons and
-* consumers under `gkm dev`, and is handed their edges' keys by `appEnvKeys`,
-* so a worker's edge counts for it too — the same rule, read the same way.
+* surface's `telemetry`, a worker's. A surface's process runs its own
+* endpoints, so a worker's edge never counts for it.
 *
 * A site's edge is recorded and never followed here: a site is handed none of
 * the node's keys (see `PUBLIC.telemetry`).
@@ -755,14 +753,7 @@ function telemetryOf(manifest, id) {
 	if (!declaration) return void 0;
 	if (declaration.kind === "worker") return nodeOf(manifest, declaration.telemetry);
 	if (declaration.kind !== "rest-api") return void 0;
-	const own = nodeOf(manifest, declaration.telemetry);
-	if (own) return own;
-	if (declaration.endpoints.length > 0) return void 0;
-	for (const other of Object.values(manifest)) {
-		if (other.kind !== "worker") continue;
-		const node = nodeOf(manifest, other.telemetry);
-		if (node) return node;
-	}
+	return nodeOf(manifest, declaration.telemetry);
 }
 /**
 * The `Telemetry` node the app `appName` emits through — its surface's, or
@@ -1042,6 +1033,10 @@ function planFor(manifest, stage, order, options = {}) {
 			} } : {},
 			...declaration.kind === "external-api" && !fake ? { url: declaration.url } : {},
 			...declaration.kind === "credential" && options.credentialFakes?.[id] !== void 0 ? { fakeCredentials: options.credentialFakes[id] } : {},
+			...declaration.kind === "secret" && (declaration.length !== void 0 || declaration.symbols !== void 0) ? { format: {
+				...declaration.length !== void 0 ? { length: declaration.length } : {},
+				...declaration.symbols !== void 0 ? { symbols: declaration.symbols } : {}
+			} } : {},
 			..."of" in declaration && !detached ? { of: declaration.of } : {},
 			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
 			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
@@ -1561,10 +1556,36 @@ function localKeyring(project, plan, resource) {
 * A hash of what identifies it, so it is stable, distinct per project, stage
 * and construct, and never written to disk as a literal. Deployed this is the
 * one kind whose value does *not* come from here — a secret manager generates
-* it once and the target reads it back.
+* it once and the target reads it back. Drawn in the format the deploy draws
+* it in, so a value that passes a third party's rules here passes them there.
 */
 function localSecret(project, plan, resource) {
-	return (0, node_crypto.createHash)("sha256").update(`${project}:${plan.stage}:${resource.id}`).digest("base64url").slice(0, 43);
+	return (0, _geekmidas_manifest.drawSecret)(hashStream(`${project}:${plan.stage}:${resource.id}`), resource.format);
+}
+/**
+* Integers in `[0, n)` drawn from a hash of `seed`, the same every time —
+* what a local secret is drawn with instead of `crypto`, so `gkm dev` and
+* `gkm test` need nothing stored. Rejection-sampled, so no character is
+* likelier than another.
+*/
+function hashStream(seed) {
+	let block = 0;
+	let bytes = Buffer.alloc(0);
+	let offset = 0;
+	const next = () => {
+		if (offset === bytes.length) {
+			bytes = (0, node_crypto.createHash)("sha256").update(`${seed}:${block++}`).digest();
+			offset = 0;
+		}
+		return bytes[offset++];
+	};
+	return (n) => {
+		const limit = 256 - 256 % n;
+		for (;;) {
+			const byte = next();
+			if (byte < limit) return byte % n;
+		}
+	};
 }
 //#endregion
 //#region src/compose/redis.ts
@@ -1722,8 +1743,8 @@ function redisService(redis) {
 *   master and roles, a bucket's root user. Derived from repo facts alone
 *   (project, stage, construct id), those passwords were computable by anyone
 *   who could read the repo.
-* - **Each `secret` construct's value** — an auth server's signing secret —
-*   random, rather than derived.
+* - **Each `secret` construct's value** — an auth server's signing secret, a
+*   `RandomPassword` — random, rather than derived, in its declared format.
 * - **Each `encryption` construct's keyring** — one random key and an index
 *   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
 *
@@ -1744,7 +1765,7 @@ function withGeneratedSecrets(secrets, manifest) {
 		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
 		const key = declaration.provides?.[0];
 		if (!key || custom[key]) continue;
-		custom[key] = declaration.kind === "encryption" ? (0, _geekmidas_constructs_encryption.generateKeyring)() : random();
+		custom[key] = declaration.kind === "encryption" ? (0, _geekmidas_constructs_encryption.generateKeyring)() : (0, _geekmidas_manifest.drawSecret)(node_crypto.randomInt, declaration);
 		generated.push(key);
 	}
 	const seed = secrets.seed ?? generateSeed();
@@ -2615,6 +2636,7 @@ function workerUnits(workspace, manifest, background) {
 	}
 	return units.sort((a, b) => a.name.localeCompare(b.name));
 }
+/** Whether `file` is inside `dir`. */
 function isUnder(file, dir) {
 	const rel = (0, node_path.relative)(dir, file);
 	return rel !== "" && !rel.startsWith("..") && !(0, node_path.isAbsolute)(rel) ? !rel.startsWith(`..${node_path.sep}`) : false;
@@ -5547,7 +5569,7 @@ async function reconcileWorkspace(workspace, options) {
 		metroPorts: metroPorts(workspace, manifest),
 		fakes,
 		credentialFakes,
-		apps: (containers) => appServices(workspace, manifest, containers, credentials, runnables, fakes),
+		apps: (containers) => appServices(workspace, manifest, containers, credentials, runnables, fakes, credentialFakes),
 		...options.start === void 0 ? {} : { start: options.start },
 		...options.progress ? { progress: options.progress } : {}
 	});
@@ -5644,11 +5666,12 @@ function dockerfileOf(appName, path) {
 * surface resolved to its `*.localhost` host on the edge's port, which the
 * rewrite to the compose network then turned into an address nothing answers.
 */
-function localPlan(workspace, manifest, fakes = {}) {
+function localPlan(workspace, manifest, fakes = {}, credentialFakes = {}) {
 	return planFor(manifest, workspace.stages.local, (0, _geekmidas_manifest.provisionOrder)(manifest), {
 		localStage: workspace.stages.local,
 		...backendsOf(workspace),
 		fakes,
+		credentialFakes,
 		edge: false
 	});
 }
@@ -5711,8 +5734,12 @@ function networkEnv(plan, options, hostOf = (container) => container) {
 *
 * One hop: a surface an app calls is reached over HTTP, so its URL is the
 * app's business and its database is not. A site also gets the public
-* variant of each key its bundle inlines (`NEXT_PUBLIC_API_URL`), and a surface
-* the edges of the workers whose crons and subscribers its server runs.
+* variant of each key its bundle inlines (`NEXT_PUBLIC_API_URL`).
+*
+* A surface's process runs its own endpoints and nothing else. A Worker's
+* crons, queue consumers and subscribers run in the worker's own process
+* (`workerEnvKeys`), so no surface is handed a worker's edges — however its
+* endpoints were found.
 *
 * `undefined` for an app no declaration describes, which gets nothing but its
 * port.
@@ -5726,20 +5753,7 @@ function appEnvKeys(manifest, appName, runnables = {}) {
 		...declaration.requires ?? [],
 		...declaration.kind === "rest-api" ? declaration.endpoints.flatMap((endpoint) => endpoint.requires ?? []) : []
 	]);
-	const edges = [...(0, _geekmidas_manifest.dependenciesOf)(declaration).map((edge) => edge.target), ...runnables[id] ?? []];
-	if (declaration.kind === "rest-api" && declaration.endpoints.length === 0) {
-		const runsWorkers = Object.values(manifest).some((other) => other.kind === "worker");
-		for (const [otherId, other] of Object.entries(manifest)) {
-			if (other.kind !== "worker") continue;
-			edges.push(...(0, _geekmidas_manifest.dependenciesOf)(other).map((edge) => edge.target), ...runnables[otherId] ?? []);
-			keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
-		}
-		if (runsWorkers) for (const other of Object.values(manifest)) {
-			if (other.kind !== "queue" && other.kind !== "topic") continue;
-			for (const key of other.provides ?? []) keys.add(key);
-		}
-	}
-	addEdgeKeys(manifest, edges, keys);
+	addEdgeKeys(manifest, [...(0, _geekmidas_manifest.dependenciesOf)(declaration).map((edge) => edge.target), ...runnables[id] ?? []], keys);
 	if (declaration.kind === "site" || declaration.kind === "mobile-app") {
 		for (const key of _geekmidas_manifest.TELEMETRY_KEYS) keys.delete(key);
 		for (const key of Object.keys((0, _geekmidas_manifest.publicEnvFor)(declaration, manifest))) keys.add(key);
@@ -5748,10 +5762,9 @@ function appEnvKeys(manifest, appName, runnables = {}) {
 }
 /**
 * The keys a Worker's own process reads: what the worker and everything built
-* from it declared an edge to, the broker its crons schedule through, and the
-* address of every queue and topic — which of them its consumers and
-* subscribers are bound to is only known once a build has found them, so a
-* process that runs them is handed each carrier's.
+* from it declared an edge to — the queues its consumers drain and the topics
+* its subscribers are bound to among them (see `DiscoverOptions.runnables`) —
+* and the broker its crons schedule through.
 *
 * `undefined` when no worker has that id.
 */
@@ -5763,10 +5776,6 @@ function workerEnvKeys(manifest, workerId, runnables = {}) {
 		...declaration.requires ?? [],
 		"EVENT_PUBLISHER_CONNECTION_STRING"
 	]);
-	for (const other of Object.values(manifest)) {
-		if (other.kind !== "queue" && other.kind !== "topic") continue;
-		for (const key of other.provides ?? []) keys.add(key);
-	}
 	addEdgeKeys(manifest, [...(0, _geekmidas_manifest.dependenciesOf)(declaration).map((edge) => edge.target), ...runnables[workerId] ?? []], keys);
 	return keys;
 }
@@ -5790,8 +5799,8 @@ function addEdgeKeys(manifest, edges, keys) {
 	}
 }
 /** One compose service per app the workspace runs, behind the apps profile. */
-function appServices(workspace, manifest, containers, credentials, runnables = {}, fakes = {}) {
-	const plan = localPlan(workspace, manifest, fakes);
+function appServices(workspace, manifest, containers, credentials, runnables = {}, fakes = {}, credentialFakes = {}) {
+	const plan = localPlan(workspace, manifest, fakes, credentialFakes);
 	const derivation = {
 		project: workspace.name,
 		credentials,
@@ -7303,7 +7312,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-JITjarl9.cjs"));
+		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-Cr9Uvqyz.cjs"));
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -8680,6 +8689,12 @@ Object.defineProperty(exports, "isTelemetryKey", {
 		return isTelemetryKey;
 	}
 });
+Object.defineProperty(exports, "isUnder", {
+	enumerable: true,
+	get: function() {
+		return isUnder;
+	}
+});
 Object.defineProperty(exports, "keystoreProject", {
 	enumerable: true,
 	get: function() {
@@ -9119,4 +9134,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-a1H3kuqu.cjs.map
+//# sourceMappingURL=seeds-DkcKQ_F8.cjs.map