@geekmidas/cli 10.0.0-alpha.118 → 10.0.0-alpha.119

package/dist/{seeds-CYzoBDg2.mjs → seeds-BBnvSEgG.mjs}

@@ -3,12 +3,12 @@ import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, ct as UnknownSecretsStoreProvider, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, j as TEST_STAGE, pt as SERVER_IPV6_KEY, ut as s3SecretsLocation, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-D1QbNd55.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { a as DEFAULT_CACHE, c as holdsEveryCache, i as readFakes, o as DEFAULT_EVENTS$1, r as readCredentialFakes, s as DEFAULT_STORAGE, t as SubscriberGenerator } from "./SubscriberGenerator-DHnIYwUU.mjs";
+import { a as readFakes, c as DEFAULT_STORAGE, i as readCredentialFakes, l as holdsEveryCache, o as DEFAULT_CACHE, s as DEFAULT_EVENTS$1, t as SubscriberGenerator } from "./SubscriberGenerator-y3pncae_.mjs";
 import { n as deployIdentity } from "./identity-CBXr4wNi.mjs";
-import { a as startTelemetryCode, n as runtimeFor, s as writeTelemetryModule, u as telemetryArgs } from "./EndpointGenerator-CvLX8bpx.mjs";
-import { d as ConstructGenerator, f as output, i as discover } from "./discover-Ca8U75dl.mjs";
+import { a as startTelemetryCode, n as runtimeFor, s as writeTelemetryModule, u as telemetryArgs } from "./EndpointGenerator-CP_z_E3e.mjs";
+import { d as ConstructGenerator, f as output, i as discover } from "./discover-C5roJuc9.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { c as runtimeOf } from "./resolve-CC6ndodR.mjs";
+import { c as runtimeOf } from "./resolve-CJwadE_F.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -26,7 +26,7 @@ import { config } from "dotenv";
 import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Queue } from "@geekmidas/constructs/queue";
-import { CreateBucketCommand, GetBucketPolicyCommand, HeadBucketCommand, ListBucketsCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, DeleteBucketLifecycleCommand, GetBucketLifecycleConfigurationCommand, GetBucketPolicyCommand, HeadBucketCommand, ListBucketsCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
 import { CreateTopicCommand, GetTopicAttributesCommand, SNSClient } from "@aws-sdk/client-sns";
 import { CreateQueueCommand, GetQueueUrlCommand, SQSClient } from "@aws-sdk/client-sqs";
 import { Client } from "pg";
@@ -1025,6 +1025,7 @@ function planFor(manifest, stage, order, options = {}) {
 				...declaration.scheme ? { scheme: declaration.scheme } : {}
 			} : {},
 			...declaration.kind === "file-server" && declaration.open?.length ? { open: declaration.open } : {},
+			...declaration.kind === "objects" && declaration.expire ? { expire: declaration.expire } : {},
 			...(declaration.kind === "rest-api" || declaration.kind === "site") && declaration.subdomain ? { subdomain: declaration.subdomain } : {},
 			...fake ? { fake: {
 				key: fake.key,
@@ -2227,24 +2228,74 @@ async function withLock(lock, body) {
 	}
 }
 //#endregion
-//#region src/reconcile/provision.ts
+//#region src/providers/s3/lifecycle.ts
 /**
-* Creating what the URLs name.
+* A bucket's lifecycle, as the constructs declare it: one expiry rule per
+* prefix, merged into whatever else the bucket's lifecycle already holds.
 *
-* Convergent and idempotent: every statement asks whether the thing exists
-* first, so reconciling repeatedly is free and a half-applied run recovers by
-* being run again. That property is what lets `gkm dev` do this on every start.
+* S3 — and MinIO, which speaks the same API — keeps one lifecycle document
+* per bucket, and a write replaces all of it. So gkm owns only the rules it
+* names (`gkm-…`): every other rule is read and put back as it was, a rule of
+* gkm's that is no longer declared is dropped, and nothing is written when
+* gkm's rules already say what the manifest does.
 *
-* The line the design draws is at data, not at side effects — this creates
-* databases, schemas, and buckets, and it never seeds, resets, or drops. A
-* developer who wants their data gone asks for it explicitly.
+* Shared by the `s3` provider and the MinIO a local or compose stack runs,
+* so a prefix expires the same way on both.
+*/
+/** The id every rule gkm writes starts with — and the only ones it touches. */
+const GKM_RULE_PREFIX = "gkm-";
+/**
+* The rule id for one prefix: readable, and unique however the prefix is
+* spelled — `a/b` and `a-b` read alike once sanitised, so a short hash of the
+* prefix itself follows.
+*/
+function expireRuleId(prefix) {
+	const readable = prefix.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 200);
+	const hash = createHash("sha256").update(prefix).digest("hex").slice(0, 8);
+	return `${GKM_RULE_PREFIX}expire-${readable ? `${readable}-` : ""}${hash}`;
+}
+/** The rules a bucket's expiry asks for, in a stable order. */
+function expireRules(expire) {
+	return Object.entries(expire ?? {}).map(([prefix, days]) => ({
+		ID: expireRuleId(prefix),
+		Status: "Enabled",
+		Filter: { Prefix: prefix },
+		Expiration: { Days: days }
+	})).sort((a, b) => a.ID.localeCompare(b.ID));
+}
+/**
+* Merge the declared expiry into the bucket's current rules.
 *
-* Statement generation is separated from application for the reason the design
-* gives: the same DDL has to run in-process locally and from a provisioner in a
-* VPC, and one implementation is what stops "works locally, fails deployed".
-* When the role DDL lands in `@geekmidas/db` this delegates to it rather than
-* growing its own.
+* @param current the bucket's rules, or nothing when it has no lifecycle
 */
+function mergeLifecycle(current, expire) {
+	const wanted = expireRules(expire);
+	const rules = current ?? [];
+	const others = rules.filter((r) => !r.ID?.startsWith(GKM_RULE_PREFIX));
+	const ours = rules.filter((r) => r.ID?.startsWith(GKM_RULE_PREFIX));
+	return {
+		changed: canonical(ours) !== canonical(wanted) || new Set(ours.map((r) => r.ID)).size !== ours.length,
+		rules: [...others, ...wanted],
+		describe: describeExpiry(expire)
+	};
+}
+/** `expire quotes/ after 30 days, tmp/ after 1 day` — or what removing says. */
+function describeExpiry(expire) {
+	const entries = Object.entries(expire ?? {}).sort(([a], [b]) => a.localeCompare(b));
+	if (entries.length === 0) return "remove expiry rules";
+	return `expire ${entries.map(([prefix, days]) => `${prefix} after ${days} day${days === 1 ? "" : "s"}`).join(", ")}`;
+}
+/** gkm's rules as the fields it sets, order-free. */
+function canonical(rules) {
+	return JSON.stringify(rules.map((r) => ({
+		id: r.ID,
+		status: r.Status,
+		prefix: r.Filter?.Prefix ?? r.Prefix ?? "",
+		days: r.Expiration?.Days ?? null
+	})).sort((a, b) => (a.id ?? "").localeCompare(b.id ?? "")));
+}
+//#endregion
+//#region src/reconcile/provision.ts
 /**
 * The Postgres work a plan implies.
 *
@@ -2430,6 +2481,20 @@ function bucketPolicies(plan) {
 	})).sort((a, b) => a.bucket.localeCompare(b.bucket));
 }
 /**
+* What each bucket keeps, and for how long: the buckets that declare an
+* expiry, by their stage-scoped name.
+*
+* Every bucket in the plan, not only those that declare one, is what a
+* removed expiry needs — its rules are dropped from a bucket that no longer
+* asks for them — so a bucket with none is listed with an empty expiry.
+*/
+function bucketLifecycles(plan) {
+	return plan.resources.filter((r) => r.kind === "objects" && r.provisions).map((r) => ({
+		bucket: r.name,
+		expire: r.expire ?? {}
+	})).sort((a, b) => a.bucket.localeCompare(b.bucket));
+}
+/**
 * One bucket's open paths as an S3 bucket policy.
 *
 * Anonymous `s3:GetObject` on the named prefixes and nothing else — which is
@@ -2517,6 +2582,34 @@ async function databasesExist(client, names) {
 	}
 }
 /**
+* Apply each bucket's expiry, beside whatever other rules it has, skipping
+* those already correct — the same merge the `s3` provider makes deployed.
+*/
+async function applyLifecycles(client, lifecycles) {
+	const applied = [];
+	for (const { bucket, expire } of lifecycles) {
+		const merge = mergeLifecycle(await client.lifecycle(bucket), expire);
+		const id = `${bucket}:lifecycle`;
+		const describe = `${merge.describe} on ${bucket}`;
+		if (!merge.changed && Object.keys(expire).length === 0) continue;
+		if (!merge.changed) {
+			applied.push({
+				id,
+				describe,
+				created: false
+			});
+			continue;
+		}
+		await client.setLifecycle(bucket, merge.rules);
+		applied.push({
+			id,
+			describe,
+			created: true
+		});
+	}
+	return applied;
+}
+/**
 * Apply each served bucket's open-path policy, skipping those already correct.
 *
 * Compared as parsed JSON rather than as text: the same policy re-serialised
@@ -4551,6 +4644,24 @@ function bucketClient(port, credentials) {
 				Bucket: bucket,
 				Policy: policy
 			}));
+		},
+		async lifecycle(bucket) {
+			try {
+				return (await s3.send(new GetBucketLifecycleConfigurationCommand({ Bucket: bucket }))).Rules;
+			} catch (error) {
+				if (error.name === "NoSuchLifecycleConfiguration") return;
+				throw error;
+			}
+		},
+		async setLifecycle(bucket, rules) {
+			if (rules.length === 0) {
+				await s3.send(new DeleteBucketLifecycleCommand({ Bucket: bucket }));
+				return;
+			}
+			await s3.send(new PutBucketLifecycleConfigurationCommand({
+				Bucket: bucket,
+				LifecycleConfiguration: { Rules: rules }
+			}));
 		}
 	};
 }
@@ -5490,10 +5601,12 @@ async function create(plan, ports, credentials, sql, buckets, emulatorCarriers,
 	const minioPort = ports[primaryPortKey("minio")];
 	const names = bucketNames(plan);
 	const policies = bucketPolicies(plan);
+	const lifecycles = bucketLifecycles(plan);
 	if (minioPort !== void 0 && (names.length > 0 || policies.length > 0)) {
 		const client = buckets(minioPort, credentials.minio);
 		if (names.length > 0) applied.push(...await applyBuckets(client, names));
 		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
+		if (lifecycles.length > 0) applied.push(...await applyLifecycles(client, lifecycles));
 	}
 	const emulatorPort = ports[primaryPortKey("localstack")];
 	const carriers = carrierNames(plan);
@@ -7383,7 +7496,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await import("./GoDaddyProvider-CcjbFkLt.mjs");
+		const { GoDaddyProvider } = await import("./GoDaddyProvider-B4JKSuX-.mjs");
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -8232,6 +8345,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { devServicesUsed as $, resolveHost as $n, isUnder as $t, assertStageProvidersEnabled as A, appTelemetry as An, isPortAvailable as At, workerDockerfileOf as B, fakeKey as Bn, maskPassword as Bt, setApplicationId as C, stackRedis as Cn, cacheBackendFor as Ct, DnsRecordsUnreadable as D, TELEMETRY_CONTAINER as Dn, createCredentialsPreload as Dt, setPostgresBackupId as E, localRolePassword as En, storageBackendFor as Et, DockerPushFailed as F, usesTelemetry as Fn, isRemoteStore as Ft, CronGenerator as G, LOCAL_LOGS_EMAIL as Gn, imageLayout as Gt, workerBundleName as H, portsOf as Hn, toEmbeddableSecrets as Ht, appDockerfile as I, EMULATOR_ACCESS_KEY_ID as In, secretsStoreFor as It, DEV_SERVICES as J, logsService as Jn, detectPackageManager as Jt, validateImageRef as K, LOGS_SERVICE as Kn, TURBO_VERSION as Kt, dockerCommand as L, hostFor as Ln, storeFromConfig as Lt, stageProviderNotes as M, scopeTelemetryEnv as Mn, loadPortState as Mt, PROVIDER_KINDS as N, surfaceClientTraced as Nn, loadSecretsForApp as Nt, createDnsProvider as O, planFor as On, createEntryWrapper as Ot, DockerBuildFailed as P, telemetryOf as Pn, prepareEntryCredentials as Pt, assertDevServicesFlag as Q, isMainFrontendApp as Qn, publicBuildValues as Qt, ensureDockerignore as R, DEFAULT_IMAGES as Rn, store_exports as Rt, recordRollback as S, runsRedis as Sn, composeFor as St, setGeneratedSecret as T, envFor as Tn, providerOf as Tt, workerEntryDir as U, postgresImage as Un, withCustomSecret as Ut, WorkerGenerator as V, portKeys as Vn, storage_exports as Vt, QueueGenerator as W, primaryPortKey as Wn, composeBuildPaths as Wt, ExternalServicesNotConfigured as X, withLogsPassword as Xn, imageBuildCredentials as Xt, DevServicesNeedServerTarget as Y, stackLogs as Yn, findBuildRoot as Yt, STORAGE_KEY_PAIR as Z, NoDomainForStage as Zn, isImageBuild as Zt, createComposeState as _, readKey as _n, LEGACY_LOCAL_LOGIN as _t, dnsResources as a, postgresDatabaseNames as an, appEnvKeys as at, getGeneratedSecret as b, STACK_CACHE as bn, pgClient as bt, describeActor as c, LOCAL_RABBITMQ_USER as cn, workerEnvKeys as ct, extractSubdomain as d, postgresSuperuser as dn, constructGlobs as dt, workerUnits as en, externalServices as et, findRootDomain as f, readLocalCredentials as fn, derivedContainers as ft, asDokployState as g, projectKey as gn, forgetState as gt, verifyDnsRecords as h, keystoreProject as hn, LOCAL_CA_PATH as ht, dnsRecordResource as i, bucketPolicies as in, suppliedOnly as it, provisionCommand as j, isTelemetryKey as jn, loadEnvFiles as jt, StageProviderDisabled as k, resourceName as kn, findAvailablePort as kt, isCi as l, loadLocalCredentials as ln, FAKE_ENV as lt, orchestrateDns as m, getKeyPath as mn, workspace_exports as mt, reportDatabaseRuns as n, applyPolicies as nn, requiredStageKeys as nt, recordDnsChanges as o, postgresStatements as on, dockerfileOf as ot, normalizeDnsConfig as p, FileSecretsStore as pn, reconcileWorkspace as pt, AllowDevServicesTakesNoValue as q, logsAccess as qn, WORKER_PORT as qt, reportPlannedSeeds as r, applyPostgres as rn, stageServiceDeclarations as rt, currentActor as s, quoteIdentifier as sn, networkEnv as st, DeploySeedsFailed as t, applyBuckets as tn, reportDevServices as tt, DeployJournal as u, postgresRoleSlug as un, backendsOf as ut, createEmptyState as v, withGeneratedSecrets as vn, ensurePostgresLogin as vt, setBackupState as w, withRedisPassword as wn, eventsBackendFor as wt, recordRelease as x, redisService as xn, CLUSTER_DATABASE as xt, getBackupState as y, REDIS_SERVICE as yn, bucketClient as yt, workerDockerfile as z, describeServices as zn, initStageSecrets as zt };
+export { devServicesUsed as $, withLogsPassword as $n, isUnder as $t, assertStageProvidersEnabled as A, TELEMETRY_CONTAINER as An, isPortAvailable as At, workerDockerfileOf as B, hostFor as Bn, maskPassword as Bt, setApplicationId as C, STACK_CACHE as Cn, cacheBackendFor as Ct, DnsRecordsUnreadable as D, withRedisPassword as Dn, createCredentialsPreload as Dt, setPostgresBackupId as E, stackRedis as En, storageBackendFor as Et, DockerPushFailed as F, scopeTelemetryEnv as Fn, isRemoteStore as Ft, CronGenerator as G, portsOf as Gn, imageLayout as Gt, workerBundleName as H, describeServices as Hn, toEmbeddableSecrets as Ht, appDockerfile as I, surfaceClientTraced as In, secretsStoreFor as It, DEV_SERVICES as J, LOCAL_LOGS_EMAIL as Jn, detectPackageManager as Jt, validateImageRef as K, postgresImage as Kn, TURBO_VERSION as Kt, dockerCommand as L, telemetryOf as Ln, storeFromConfig as Lt, stageProviderNotes as M, resourceName as Mn, loadPortState as Mt, PROVIDER_KINDS as N, appTelemetry as Nn, loadSecretsForApp as Nt, createDnsProvider as O, envFor as On, createEntryWrapper as Ot, DockerBuildFailed as P, isTelemetryKey as Pn, prepareEntryCredentials as Pt, assertDevServicesFlag as Q, stackLogs as Qn, publicBuildValues as Qt, ensureDockerignore as R, usesTelemetry as Rn, store_exports as Rt, recordRollback as S, REDIS_SERVICE as Sn, composeFor as St, setGeneratedSecret as T, runsRedis as Tn, providerOf as Tt, workerEntryDir as U, fakeKey as Un, withCustomSecret as Ut, WorkerGenerator as V, DEFAULT_IMAGES as Vn, storage_exports as Vt, QueueGenerator as W, portKeys as Wn, composeBuildPaths as Wt, ExternalServicesNotConfigured as X, logsAccess as Xn, imageBuildCredentials as Xt, DevServicesNeedServerTarget as Y, LOGS_SERVICE as Yn, findBuildRoot as Yt, STORAGE_KEY_PAIR as Z, logsService as Zn, isImageBuild as Zt, createComposeState as _, getKeyPath as _n, LEGACY_LOCAL_LOGIN as _t, dnsResources as a, bucketLifecycles as an, appEnvKeys as at, getGeneratedSecret as b, readKey as bn, pgClient as bt, describeActor as c, postgresStatements as cn, workerEnvKeys as ct, extractSubdomain as d, LOCAL_RABBITMQ_USER as dn, constructGlobs as dt, workerUnits as en, NoDomainForStage as er, externalServices as et, findRootDomain as f, loadLocalCredentials as fn, derivedContainers as ft, asDokployState as g, FileSecretsStore as gn, forgetState as gt, verifyDnsRecords as h, readLocalCredentials as hn, LOCAL_CA_PATH as ht, dnsRecordResource as i, applyPostgres as in, suppliedOnly as it, provisionCommand as j, planFor as jn, loadEnvFiles as jt, StageProviderDisabled as k, localRolePassword as kn, findAvailablePort as kt, isCi as l, quoteIdentifier as ln, FAKE_ENV as lt, orchestrateDns as m, postgresSuperuser as mn, workspace_exports as mt, reportDatabaseRuns as n, applyLifecycles as nn, resolveHost as nr, requiredStageKeys as nt, recordDnsChanges as o, bucketPolicies as on, dockerfileOf as ot, normalizeDnsConfig as p, postgresRoleSlug as pn, reconcileWorkspace as pt, AllowDevServicesTakesNoValue as q, primaryPortKey as qn, WORKER_PORT as qt, reportPlannedSeeds as r, applyPolicies as rn, stageServiceDeclarations as rt, currentActor as s, postgresDatabaseNames as sn, networkEnv as st, DeploySeedsFailed as t, applyBuckets as tn, isMainFrontendApp as tr, reportDevServices as tt, DeployJournal as u, mergeLifecycle as un, backendsOf as ut, createEmptyState as v, keystoreProject as vn, ensurePostgresLogin as vt, setBackupState as w, redisService as wn, eventsBackendFor as wt, recordRelease as x, withGeneratedSecrets as xn, CLUSTER_DATABASE as xt, getBackupState as y, projectKey as yn, bucketClient as yt, workerDockerfile as z, EMULATOR_ACCESS_KEY_ID as zn, initStageSecrets as zt };
 
-//# sourceMappingURL=seeds-CYzoBDg2.mjs.map
+//# sourceMappingURL=seeds-BBnvSEgG.mjs.map