@geekmidas/cli 10.0.0-alpha.117 → 10.0.0-alpha.119

package/dist/{seeds-DWaiMMi3.cjs → seeds-CPFoexOv.cjs}

@@ -3,12 +3,12 @@ const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_workspace = require("./workspace-BwqQnool.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-CeH7wbYt.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-C8CPxrCK.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_EndpointGenerator = require("./EndpointGenerator-BwbYTMtB.cjs");
-const require_discover = require("./discover-Bsr7HjqJ.cjs");
+const require_EndpointGenerator = require("./EndpointGenerator-BDa6pPgE.cjs");
+const require_discover = require("./discover-DozUKs8f.cjs");
 const require_config = require("./config.cjs");
-const require_resolve = require("./resolve-BHR-Ewxo.cjs");
+const require_resolve = require("./resolve-Dtrp53jt.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -329,8 +329,9 @@ function postgresImage(version) {
 * The default image for each container.
 *
 * Pinned to a major rather than `latest` where the image publishes one, so a
-* rebuild does not silently move a developer's Postgres a version. Overridable
-* per project: a project needing `postgis/postgis` says so in config.
+* rebuild does not silently move a developer's Postgres a version. A database
+* can name its own (`image: 'postgis/postgis:…'`); any other pin is the
+* project's own `docker-compose.yml`.
 */
 const DEFAULT_IMAGES = {
 	postgres: postgresImage(_geekmidas_manifest.DEFAULT_POSTGRES_VERSION),
@@ -1026,6 +1027,7 @@ function planFor(manifest, stage, order, options = {}) {
 				...declaration.scheme ? { scheme: declaration.scheme } : {}
 			} : {},
 			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
+			...declaration.kind === "objects" && declaration.expire ? { expire: declaration.expire } : {},
 			...(declaration.kind === "rest-api" || declaration.kind === "site") && declaration.subdomain ? { subdomain: declaration.subdomain } : {},
 			...fake ? { fake: {
 				key: fake.key,
@@ -1040,6 +1042,8 @@ function planFor(manifest, stage, order, options = {}) {
 			..."of" in declaration && !detached ? { of: declaration.of } : {},
 			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
 			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
+			..."image" in declaration && declaration.image ? { image: declaration.image } : {},
+			..."extensions" in declaration && declaration.extensions?.length ? { extensions: declaration.extensions } : {},
 			..."roles" in declaration && declaration.roles === false ? { roles: false } : {},
 			..."table" in declaration && declaration.table && !detached ? { table: declaration.table } : {}
 		});
@@ -2226,24 +2230,74 @@ async function withLock(lock, body) {
 	}
 }
 //#endregion
-//#region src/reconcile/provision.ts
+//#region src/providers/s3/lifecycle.ts
 /**
-* Creating what the URLs name.
+* A bucket's lifecycle, as the constructs declare it: one expiry rule per
+* prefix, merged into whatever else the bucket's lifecycle already holds.
 *
-* Convergent and idempotent: every statement asks whether the thing exists
-* first, so reconciling repeatedly is free and a half-applied run recovers by
-* being run again. That property is what lets `gkm dev` do this on every start.
+* S3 — and MinIO, which speaks the same API — keeps one lifecycle document
+* per bucket, and a write replaces all of it. So gkm owns only the rules it
+* names (`gkm-…`): every other rule is read and put back as it was, a rule of
+* gkm's that is no longer declared is dropped, and nothing is written when
+* gkm's rules already say what the manifest does.
 *
-* The line the design draws is at data, not at side effects — this creates
-* databases, schemas, and buckets, and it never seeds, resets, or drops. A
-* developer who wants their data gone asks for it explicitly.
+* Shared by the `s3` provider and the MinIO a local or compose stack runs,
+* so a prefix expires the same way on both.
+*/
+/** The id every rule gkm writes starts with — and the only ones it touches. */
+const GKM_RULE_PREFIX = "gkm-";
+/**
+* The rule id for one prefix: readable, and unique however the prefix is
+* spelled — `a/b` and `a-b` read alike once sanitised, so a short hash of the
+* prefix itself follows.
+*/
+function expireRuleId(prefix) {
+	const readable = prefix.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 200);
+	const hash = (0, node_crypto.createHash)("sha256").update(prefix).digest("hex").slice(0, 8);
+	return `${GKM_RULE_PREFIX}expire-${readable ? `${readable}-` : ""}${hash}`;
+}
+/** The rules a bucket's expiry asks for, in a stable order. */
+function expireRules(expire) {
+	return Object.entries(expire ?? {}).map(([prefix, days]) => ({
+		ID: expireRuleId(prefix),
+		Status: "Enabled",
+		Filter: { Prefix: prefix },
+		Expiration: { Days: days }
+	})).sort((a, b) => a.ID.localeCompare(b.ID));
+}
+/**
+* Merge the declared expiry into the bucket's current rules.
 *
-* Statement generation is separated from application for the reason the design
-* gives: the same DDL has to run in-process locally and from a provisioner in a
-* VPC, and one implementation is what stops "works locally, fails deployed".
-* When the role DDL lands in `@geekmidas/db` this delegates to it rather than
-* growing its own.
+* @param current the bucket's rules, or nothing when it has no lifecycle
 */
+function mergeLifecycle(current, expire) {
+	const wanted = expireRules(expire);
+	const rules = current ?? [];
+	const others = rules.filter((r) => !r.ID?.startsWith(GKM_RULE_PREFIX));
+	const ours = rules.filter((r) => r.ID?.startsWith(GKM_RULE_PREFIX));
+	return {
+		changed: canonical(ours) !== canonical(wanted) || new Set(ours.map((r) => r.ID)).size !== ours.length,
+		rules: [...others, ...wanted],
+		describe: describeExpiry(expire)
+	};
+}
+/** `expire quotes/ after 30 days, tmp/ after 1 day` — or what removing says. */
+function describeExpiry(expire) {
+	const entries = Object.entries(expire ?? {}).sort(([a], [b]) => a.localeCompare(b));
+	if (entries.length === 0) return "remove expiry rules";
+	return `expire ${entries.map(([prefix, days]) => `${prefix} after ${days} day${days === 1 ? "" : "s"}`).join(", ")}`;
+}
+/** gkm's rules as the fields it sets, order-free. */
+function canonical(rules) {
+	return JSON.stringify(rules.map((r) => ({
+		id: r.ID,
+		status: r.Status,
+		prefix: r.Filter?.Prefix ?? r.Prefix ?? "",
+		days: r.Expiration?.Days ?? null
+	})).sort((a, b) => (a.id ?? "").localeCompare(b.id ?? "")));
+}
+//#endregion
+//#region src/reconcile/provision.ts
 /**
 * The Postgres work a plan implies.
 *
@@ -2343,6 +2397,7 @@ function rolesFor(resource, schema, plan, project, seed) {
 		...reader ? { reader } : {},
 		schema,
 		...resource.kind === "database" ? { database: rootDatabase(resource, plan) } : {},
+		...resource.extensions ? { extensions: resource.extensions } : {},
 		passwords: {
 			runtime: localRolePassword(project, plan, runtime, seed),
 			owner: localRolePassword(project, plan, owner, seed),
@@ -2428,6 +2483,20 @@ function bucketPolicies(plan) {
 	})).sort((a, b) => a.bucket.localeCompare(b.bucket));
 }
 /**
+* What each bucket keeps, and for how long: the buckets that declare an
+* expiry, by their stage-scoped name.
+*
+* Every bucket in the plan, not only those that declare one, is what a
+* removed expiry needs — its rules are dropped from a bucket that no longer
+* asks for them — so a bucket with none is listed with an empty expiry.
+*/
+function bucketLifecycles(plan) {
+	return plan.resources.filter((r) => r.kind === "objects" && r.provisions).map((r) => ({
+		bucket: r.name,
+		expire: r.expire ?? {}
+	})).sort((a, b) => a.bucket.localeCompare(b.bucket));
+}
+/**
 * One bucket's open paths as an S3 bucket policy.
 *
 * Anonymous `s3:GetObject` on the named prefixes and nothing else — which is
@@ -2515,6 +2584,34 @@ async function databasesExist(client, names) {
 	}
 }
 /**
+* Apply each bucket's expiry, beside whatever other rules it has, skipping
+* those already correct — the same merge the `s3` provider makes deployed.
+*/
+async function applyLifecycles(client, lifecycles) {
+	const applied = [];
+	for (const { bucket, expire } of lifecycles) {
+		const merge = mergeLifecycle(await client.lifecycle(bucket), expire);
+		const id = `${bucket}:lifecycle`;
+		const describe = `${merge.describe} on ${bucket}`;
+		if (!merge.changed && Object.keys(expire).length === 0) continue;
+		if (!merge.changed) {
+			applied.push({
+				id,
+				describe,
+				created: false
+			});
+			continue;
+		}
+		await client.setLifecycle(bucket, merge.rules);
+		applied.push({
+			id,
+			describe,
+			created: true
+		});
+	}
+	return applied;
+}
+/**
 * Apply each served bucket's open-path policy, skipping those already correct.
 *
 * Compared as parsed JSON rather than as text: the same policy re-serialised
@@ -4181,8 +4278,9 @@ function composeFor(plan, options) {
 	const volumes = {};
 	for (const container of [...plan.containers].sort()) {
 		const declared = container === "postgres" ? plan.resources.find((r) => r.version)?.version : void 0;
+		const named = container === "postgres" ? declaredPostgresImage(plan) : void 0;
 		const fake = plan.fakes?.[container];
-		const image = declared ? postgresImage(declared) : fake?.image ?? DEFAULT_IMAGES[container];
+		const image = named ?? (declared ? postgresImage(declared) : fake?.image ?? DEFAULT_IMAGES[container]);
 		if (!image) throw new UnknownContainer(container);
 		const published = publish(container, options.ports, plan.fakes);
 		services[container] = fake ? {
@@ -4217,6 +4315,28 @@ function toYaml(file) {
 ${(0, yaml.stringify)(file, { lineWidth: 0 })}`;
 }
 /** A container with no image, from config or from the defaults. */
+/**
+* The image the databases in the plan named for the shared local cluster, if
+* any did.
+*/
+function declaredPostgresImage(plan) {
+	const named = plan.resources.filter((r) => r.kind === "database" && Boolean(r.image));
+	const images = [...new Set(named.map((r) => r.image))];
+	if (images.length > 1) throw new ConflictingPostgresImages(named.map((r) => ({
+		id: r.id,
+		image: r.image
+	})));
+	return images[0];
+}
+/** Two databases on the one local cluster named different images for it. */
+var ConflictingPostgresImages = class extends Error {
+	databases;
+	constructor(databases) {
+		super(`Locally every database runs in one Postgres container, and these name different images for it: ${databases.map((d) => `${d.id} (${d.image})`).join(", ")}. Give them the same image — one that ships every extension they declare.`);
+		this.databases = databases;
+		this.name = "ConflictingPostgresImages";
+	}
+};
 var UnknownContainer = class extends Error {
 	/** The container that could not be resolved. */
 	container;
@@ -4526,6 +4646,24 @@ function bucketClient(port, credentials) {
 				Bucket: bucket,
 				Policy: policy
 			}));
+		},
+		async lifecycle(bucket) {
+			try {
+				return (await s3.send(new _aws_sdk_client_s3.GetBucketLifecycleConfigurationCommand({ Bucket: bucket }))).Rules;
+			} catch (error) {
+				if (error.name === "NoSuchLifecycleConfiguration") return;
+				throw error;
+			}
+		},
+		async setLifecycle(bucket, rules) {
+			if (rules.length === 0) {
+				await s3.send(new _aws_sdk_client_s3.DeleteBucketLifecycleCommand({ Bucket: bucket }));
+				return;
+			}
+			await s3.send(new _aws_sdk_client_s3.PutBucketLifecycleConfigurationCommand({
+				Bucket: bucket,
+				LifecycleConfiguration: { Rules: rules }
+			}));
 		}
 	};
 }
@@ -5465,10 +5603,12 @@ async function create(plan, ports, credentials, sql, buckets, emulatorCarriers,
 	const minioPort = ports[primaryPortKey("minio")];
 	const names = bucketNames(plan);
 	const policies = bucketPolicies(plan);
+	const lifecycles = bucketLifecycles(plan);
 	if (minioPort !== void 0 && (names.length > 0 || policies.length > 0)) {
 		const client = buckets(minioPort, credentials.minio);
 		if (names.length > 0) applied.push(...await applyBuckets(client, names));
 		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
+		if (lifecycles.length > 0) applied.push(...await applyLifecycles(client, lifecycles));
 	}
 	const emulatorPort = ports[primaryPortKey("localstack")];
 	const carriers = carrierNames(plan);
@@ -7358,7 +7498,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-DY4QFpCg.cjs"));
+		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-DMLcXGTd.cjs"));
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -8429,6 +8569,12 @@ Object.defineProperty(exports, "applyBuckets", {
 		return applyBuckets;
 	}
 });
+Object.defineProperty(exports, "applyLifecycles", {
+	enumerable: true,
+	get: function() {
+		return applyLifecycles;
+	}
+});
 Object.defineProperty(exports, "applyPolicies", {
 	enumerable: true,
 	get: function() {
@@ -8471,6 +8617,12 @@ Object.defineProperty(exports, "bucketClient", {
 		return bucketClient;
 	}
 });
+Object.defineProperty(exports, "bucketLifecycles", {
+	enumerable: true,
+	get: function() {
+		return bucketLifecycles;
+	}
+});
 Object.defineProperty(exports, "bucketPolicies", {
 	enumerable: true,
 	get: function() {
@@ -8795,6 +8947,12 @@ Object.defineProperty(exports, "maskPassword", {
 		return maskPassword;
 	}
 });
+Object.defineProperty(exports, "mergeLifecycle", {
+	enumerable: true,
+	get: function() {
+		return mergeLifecycle;
+	}
+});
 Object.defineProperty(exports, "networkEnv", {
 	enumerable: true,
 	get: function() {
@@ -9186,4 +9344,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-DWaiMMi3.cjs.map
+//# sourceMappingURL=seeds-CPFoexOv.cjs.map