@geekmidas/cli 10.0.0-alpha.111 → 10.0.0-alpha.113

package/dist/index.cjs

@@ -57,7 +57,7 @@ crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let _geekmidas_constructs_functions = require("@geekmidas/constructs/functions");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 //#region package.json
-var version = "10.0.0-alpha.111";
+var version = "10.0.0-alpha.113";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -5949,25 +5949,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.111",
-	"@geekmidas/auth": "~10.0.0-alpha.111",
-	"@geekmidas/cache": "~10.0.0-alpha.111",
-	"@geekmidas/client": "~10.0.0-alpha.111",
-	"@geekmidas/cloud": "~10.0.0-alpha.111",
-	"@geekmidas/constructs": "~10.0.0-alpha.111",
-	"@geekmidas/db": "~10.0.0-alpha.111",
-	"@geekmidas/emailkit": "~10.0.0-alpha.111",
-	"@geekmidas/envkit": "~10.0.0-alpha.111",
-	"@geekmidas/errors": "~10.0.0-alpha.111",
-	"@geekmidas/events": "~10.0.0-alpha.111",
-	"@geekmidas/logger": "~10.0.0-alpha.111",
-	"@geekmidas/manifest": "~10.0.0-alpha.111",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.111",
-	"@geekmidas/schema": "~10.0.0-alpha.111",
-	"@geekmidas/services": "~10.0.0-alpha.111",
-	"@geekmidas/storage": "~10.0.0-alpha.111",
-	"@geekmidas/telescope": "~10.0.0-alpha.111",
-	"@geekmidas/testkit": "~10.0.0-alpha.111",
+	"@geekmidas/audit": "~10.0.0-alpha.113",
+	"@geekmidas/auth": "~10.0.0-alpha.113",
+	"@geekmidas/cache": "~10.0.0-alpha.113",
+	"@geekmidas/client": "~10.0.0-alpha.113",
+	"@geekmidas/cloud": "~10.0.0-alpha.113",
+	"@geekmidas/constructs": "~10.0.0-alpha.113",
+	"@geekmidas/db": "~10.0.0-alpha.113",
+	"@geekmidas/emailkit": "~10.0.0-alpha.113",
+	"@geekmidas/envkit": "~10.0.0-alpha.113",
+	"@geekmidas/errors": "~10.0.0-alpha.113",
+	"@geekmidas/events": "~10.0.0-alpha.113",
+	"@geekmidas/logger": "~10.0.0-alpha.113",
+	"@geekmidas/manifest": "~10.0.0-alpha.113",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.113",
+	"@geekmidas/schema": "~10.0.0-alpha.113",
+	"@geekmidas/services": "~10.0.0-alpha.113",
+	"@geekmidas/storage": "~10.0.0-alpha.113",
+	"@geekmidas/telescope": "~10.0.0-alpha.113",
+	"@geekmidas/testkit": "~10.0.0-alpha.113",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -7160,7 +7160,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "8a63c47fd347367a03f2dfe1c3ea031556ede424", version = cliVersion()) {
+function stagesActionUses(commit = "18d6b7860652d3db231d361933ee2d5ec10f0941", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -7627,6 +7627,7 @@ ${registryLogin(registry)}
       # pinned host key (DEPLOY_KNOWN_HOSTS, a variable) on each environment:
       # never accepted on first sight. The server — user and host — is
       # deploy.compose.server in gkm.config.ts and the stage's GKM_SERVER_IPV4.
+      # \`gkm compose:server --stage <stage>\` sets the server up and gives both.
       - name: SSH to the server
         run: |
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
@@ -7659,26 +7660,6 @@ ${registryLogin(registry)}
           SHA: \${{ steps.commit.outputs.sha }}
           GODADDY_API_TOKEN: \${{ secrets.GODADDY_API_TOKEN }}
           HOSTINGER_API_TOKEN: \${{ secrets.HOSTINGER_API_TOKEN }}
-${options.mobileApp ? publishMobile(pm.exec) : ""}`;
-}
-/**
-* The phone app, once its stage's servers run this release: its values
-* synced to the stage's EAS environment, then an update on the stage's
-* channel when a store build has its native code, or a store build
-* submitted to the stores when none does (\`gkm publish\`). The build runs
-* on EAS; this step only starts it.
-*/
-function publishMobile(exec) {
-	return `
-      # The phone app, after its servers: an update when a store build has
-      # this native code, a store build submitted to the stores when none
-      # does. EXPO_TOKEN is a secret on the stage's environment (an EAS
-      # access token); the build runs on EAS, not here.
-      - name: Publish the app
-        run: ${exec} gkm publish --stage "$STAGE"
-        env:
-          STAGE: \${{ matrix.stage }}
-          EXPO_TOKEN: \${{ secrets.EXPO_TOKEN }}
 `;
 }
 /**
@@ -7784,6 +7765,97 @@ function generateGithubFiles(options) {
 	return files;
 }
 //#endregion
+//#region src/mobile/easWorkflow.ts
+/**
+* A stage's EAS workflow (`.eas/workflows/publish-<stage>.yml`): what
+* `gkm publish` does, run by EAS itself — so shipping the app needs no CI
+* of the project's own, no runner and no token in GitHub.
+*
+* Per platform: the native code's fingerprint, read with the stage's EAS
+* environment; a finished store build of the stage's profile with that
+* fingerprint; then an update on the stage's channel when there is one, or
+* a store build, submitted with the stage's submit profile, when there is
+* not. iOS is submitted once `submit.<stage>.ios.ascAppId` is set — until
+* then it is built and not submitted.
+*
+* It runs when the stage is deployed: the protected stage on a release tag
+* (`v*`), every other deployed stage on a push to `main` — and on demand,
+* `eas workflow:run .eas/workflows/publish-<stage>.yml`. The values a build
+* reads are the stage's EAS environment, which `gkm eas:sync` keeps.
+*
+* Generated: written by `gkm eas:sync`, and overwritten by the next one.
+*/
+/** Where a stage's workflow is written, relative to the app. */
+function easWorkflowPath(stage) {
+	return `.eas/workflows/publish-${stage}.yml`;
+}
+/** The stage's EAS workflow, as YAML. */
+function easWorkflow(stage, options) {
+	const profile = stage.stage;
+	const jobs = { fingerprint: {
+		name: "Fingerprint",
+		type: "fingerprint",
+		environment: stage.environment
+	} };
+	for (const platform of ["android", "ios"]) {
+		const existing = `get_${platform}_build`;
+		const build = `build_${platform}`;
+		const name = platform === "ios" ? "iOS" : "Android";
+		jobs[existing] = {
+			name: `Find an ${name} store build with this native code`,
+			needs: ["fingerprint"],
+			type: "get-build",
+			params: {
+				fingerprint_hash: `\${{ needs.fingerprint.outputs.${platform}_fingerprint_hash }}`,
+				profile,
+				platform,
+				distribution: "store"
+			}
+		};
+		jobs[build] = {
+			name: `Build ${name}`,
+			needs: [existing],
+			if: `\${{ !needs.${existing}.outputs.build_id }}`,
+			type: "build",
+			params: {
+				platform,
+				profile
+			}
+		};
+		if (platform === "android" || options.iosSubmits) jobs[`submit_${platform}`] = {
+			name: `Submit ${name}`,
+			needs: [build],
+			type: "submit",
+			params: {
+				build_id: `\${{ needs.${build}.outputs.build_id }}`,
+				profile
+			}
+		};
+		jobs[`update_${platform}`] = {
+			name: `Update ${name} on '${stage.channel}'`,
+			needs: [existing],
+			if: `\${{ needs.${existing}.outputs.build_id }}`,
+			type: "update",
+			environment: stage.environment,
+			params: {
+				platform,
+				channel: stage.channel
+			}
+		};
+	}
+	return `${[
+		`# Generated by \`gkm eas:sync --stage ${stage.stage}\`: run it again rather than`,
+		"# editing this file. An update when a store build has this native code,",
+		`# a store build submitted to the stores when none does. Run by hand:`,
+		`#   eas workflow:run ${easWorkflowPath(stage.stage)}`,
+		""
+	].join("\n")}${(0, yaml.stringify)({
+		name: `Publish to ${stage.stage}`,
+		on: options.release ? { push: { tags: ["v*"] } } : { push: { branches: ["main"] } },
+		jobs
+	}, { lineWidth: 0 })}`;
+}
+//#endregion
 //#region src/mobile/stage.ts
 /** A `MobileApp`'s `stages` names a stage the project does not deploy. */
 var MobileAppStageUndeclared = class extends require_errors.GkmError {
@@ -8702,6 +8774,35 @@ export default function SigningInScreen() {
     </SafeAreaView>
   );
 }
+`;
+	const appConstructTs = `import { MobileApp } from '@geekmidas/constructs/mobile-app';
+import { api } from './api.ts';
+import { auth } from './auth.ts';
+import { email } from './email.ts';
+
+/**
+ * The mobile app — a construct like a site, which is what makes it an app.
+ *
+ * \`.dependsOn()\` is the single fact behind what a mobile app otherwise has
+ * written down by hand: its API and auth URLs, its URL scheme, the scheme in
+ * the auth server's trusted origins, Better Auth's Expo plugin, sign-in links
+ * a phone can open — and, on a local stage, the mailer's inbox, so a link sent
+ * in development is read on the device.
+ */
+export const app = new MobileApp('App', { path: 'apps/app' }).dependsOn([
+  api,
+  auth,
+  email,
+]);
+`;
+	const gitignore = `node_modules/
+.expo/
+dist/
+*.log
+.env*.local
+ios/
+android/
+.eas/
 `;
 	return [
 		{
@@ -8716,6 +8817,13 @@ export default function SigningInScreen() {
 			path: "apps/app/eas.json",
 			content: `${JSON.stringify(easJson, null, 2)}\n`
 		},
+		...stages.map((stage) => ({
+			path: `apps/app/${easWorkflowPath(stage.stage)}`,
+			content: easWorkflow(stage, {
+				release: options.stages.protected?.includes(stage.stage) ?? false,
+				iosSubmits: false
+			})
+		})),
 		{
 			path: "apps/app/babel.config.js",
 			content: babelConfig
@@ -8806,38 +8914,11 @@ export default function SigningInScreen() {
 		},
 		{
 			path: "apps/app/.gitignore",
-			content: `node_modules/
-.expo/
-dist/
-*.log
-.env*.local
-ios/
-android/
-.eas/
-`
+			content: gitignore
 		},
 		{
 			path: "constructs/app.ts",
-			content: `import { MobileApp } from '@geekmidas/constructs/mobile-app';
-import { api } from './api.ts';
-import { auth } from './auth.ts';
-import { email } from './email.ts';
-
-/**
- * The mobile app — a construct like a site, which is what makes it an app.
- *
- * \`.dependsOn()\` is the single fact behind what a mobile app otherwise has
- * written down by hand: its API and auth URLs, its URL scheme, the scheme in
- * the auth server's trusted origins, Better Auth's Expo plugin, sign-in links
- * a phone can open — and, on a local stage, the mailer's inbox, so a link sent
- * in development is read on the device.
- */
-export const app = new MobileApp('App', { path: 'apps/app' }).dependsOn([
-  api,
-  auth,
-  email,
-]);
-`
+			content: appConstructTs
 		}
 	];
 }
@@ -16339,7 +16420,7 @@ program.command("eas:sync").description("Set up a mobile app's EAS project for a
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { easSync } = await Promise.resolve().then(() => require("./eas-BkLA60P2.cjs"));
+		const { easSync } = await Promise.resolve().then(() => require("./eas-Cne743nQ.cjs"));
 		await easSync(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16349,7 +16430,7 @@ program.command("publish").description("Ship a mobile app for a deployed stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { publish, PublishModeConflict } = await Promise.resolve().then(() => require("./publish-CPgSbtcs.cjs"));
+		const { publish, PublishModeConflict } = await Promise.resolve().then(() => require("./publish-SDG1WfYn.cjs"));
 		if (options.build && options.update) throw new PublishModeConflict();
 		const { build, update, ...rest } = options;
 		await publish({
@@ -16365,7 +16446,7 @@ program.command("deploy:google-play").description("Let EAS Submit publish a mobi
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGooglePlay } = await Promise.resolve().then(() => require("./googlePlay-DNgybe5t.cjs"));
+		const { deployGooglePlay } = await Promise.resolve().then(() => require("./googlePlay-B6uiHi65.cjs"));
 		await deployGooglePlay(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16640,6 +16721,16 @@ program.command("deploy:rollback").description("Put a stage's app back on its pr
 		exitWithError(error);
 	}
 });
+program.command("compose:server").description("Set up a stage's server for compose deploys: harden it (SSH keys only, no root login, firewall, security updates, fail2ban), install Docker, create the deploy user, and give its key to GitHub").requiredOption("--stage <stage>", "A deployed stage from gkm.config.ts").option("--admin <user>", "The sudo user you log in to the server as — never root (asked when absent)").option("--key-file <path>", "The deploy key pair (default: ~/.ssh/gkm-<project>-<stage>)").option("--repo <owner/name>", "GitHub repository (default: this one)").option("--no-github", "Leave the GitHub environment's key and host alone").option("--yes", "Set the server up without asking first").option("--dry-run", "Print the plan and the script; connect to nothing").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { composeServerCommand } = await Promise.resolve().then(() => require("./serverSetup-BCbD8ksJ.cjs"));
+		await composeServerCommand(options);
+	} catch (error) {
+		exitWithError(error);
+	}
+});
 program.command("deploy:init").description("Initialize Dokploy deployment (create project and application)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").requiredOption("--project <name>", "Project name (creates if not exists)").requiredOption("--app <name>", "Application name").option("--project-id <id>", "Use existing project ID instead of creating").option("--registry-id <id>", "Configure registry for the application").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -16659,7 +16750,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-DDOHjdS9.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-C3gblUvr.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16839,6 +16930,8 @@ try {
 program.parse();
 //#endregion
 exports.canPrompt = canPrompt;
+exports.easWorkflow = easWorkflow;
+exports.easWorkflowPath = easWorkflowPath;
 exports.formatError = formatError;
 exports.generateFullstackCustomSecrets = generateFullstackCustomSecrets;
 exports.mobileStage = mobileStage;