@geekmidas/cli 10.0.0-alpha.118 → 10.0.0-alpha.119

package/dist/{compose-JOasAHcd.cjs → compose-tZLAZZp6.cjs}

@@ -2,14 +2,14 @@ const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_workspace = require("./workspace-BwqQnool.cjs");
-const require_dns = require("./dns-DfQKqAyt.cjs");
+const require_dns = require("./dns-CJ3izGTo.cjs");
 const require_define = require("./define-crmMcXFS.cjs");
-const require_seeds = require("./seeds-CF9Nx6_g.cjs");
+const require_seeds = require("./seeds-CPFoexOv.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-CeH7wbYt.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-C8CPxrCK.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_discover = require("./discover-Bsr7HjqJ.cjs");
-const require_drivers = require("./drivers-CoqD5zYP.cjs");
+const require_discover = require("./discover-DozUKs8f.cjs");
+const require_drivers = require("./drivers-DbjiYpW6.cjs");
 const require_databases = require("./databases-DGALFDG3.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -684,7 +684,7 @@ function edgeCaddyfile(routes, options) {
 ` : tls.kind === "files" ? `
 	tls ${tls.certFile} ${tls.keyFile}
 ` : "";
-	const blocks = routes.map(({ host, upstreams, prefix, allow, streaming }) => `https://${host} {${certificate}
+	const blocks = routes.map(({ host, upstreams, prefix, allow, paths, streaming }) => `https://${host} {${certificate}
 	# gkm's own header, which only a service of this stack may send: the auth
 	# server rate-limits by the client address it carries.
 	request_header -${_geekmidas_manifest.CLIENT_IP_HEADER}
@@ -693,6 +693,11 @@ ${allow ? `
 	# could set. Everything else is refused before it reaches the upstream.
 	@denied not remote_ip ${allow.join(" ")}
 	respond @denied 403
+` : ""}${paths ? `
+	# Only these paths answer. Everything else on this host is refused before
+	# it reaches the upstream.
+	@elsewhere not path ${paths.join(" ")}
+	respond @elsewhere 404
 ` : ""}${prefix ? `
 	# A bucket, served at a host of its own: the bucket is a prefix on MinIO,
 	# which routes and signs on the Host header — so it is sent the upstream's.
@@ -713,8 +718,9 @@ ${allow ? `
 const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
 #
 # One host per API and site, each in front of its own container, one per
-# file server in front of the stack's MinIO, and — when its logs are served
-# publicly — one for OpenObserve, to the addresses it allows.
+# file server in front of the stack's MinIO, one per worker SNS pushes to,
+# answering only those routes, and — when its logs are served publicly — one
+# for OpenObserve, to the addresses it allows.
 `;
 //#endregion
 //#region src/compose/images.ts
@@ -1013,8 +1019,9 @@ function traefikDynamic(routes, options) {
 			middlewares[name(route, "prefix")] = { addPrefix: { prefix: route.prefix } };
 			chain.push(name(route, "prefix"));
 		}
+		const paths = route.paths ? ` && (${route.paths.map((path) => `Path(\`${path}\`)`).join(" || ")})` : "";
 		routers[name(route)] = {
-			rule: `Host(\`${route.host}\`)`,
+			rule: `Host(\`${route.host}\`)${paths}`,
 			entryPoints: ["websecure"],
 			service: name(route),
 			middlewares: chain,
@@ -1425,7 +1432,8 @@ function composeStack(input) {
 		return {
 			...credential.containers.minio,
 			buckets,
-			policies: require_seeds.bucketPolicies(plan).filter((p) => buckets.includes(p.bucket))
+			policies: require_seeds.bucketPolicies(plan).filter((p) => buckets.includes(p.bucket)),
+			lifecycles: require_seeds.bucketLifecycles(plan).filter((l) => buckets.includes(l.bucket))
 		};
 	})() : void 0;
 	const fileServers = /* @__PURE__ */ new Map();
@@ -1572,16 +1580,26 @@ function composeStack(input) {
 	}
 	for (const worker of input.buildOnly ? [] : workers) {
 		const keys = require_seeds.workerEnvKeys(manifest, worker.id, input.runnables) ?? /* @__PURE__ */ new Set();
+		const resolved = valuesFor({
+			name: worker.name,
+			id: worker.id,
+			kind: "rest-api"
+		}, keys);
+		const push = local ? void 0 : workerPush(worker, input.subscribers?.[worker.id] ?? [], resolved, {
+			stage,
+			...domain ? { domain } : {}
+		});
+		if (push) {
+			worker.push = push;
+			if (proxy === "traefik") edgeServices.add(worker.name);
+		}
 		worker.env = {
-			...require_seeds.scopeTelemetryEnv(valuesFor({
-				name: worker.name,
-				id: worker.id,
-				kind: "rest-api"
-			}, keys), {
+			...require_seeds.scopeTelemetryEnv(resolved, {
 				uses: require_seeds.telemetryOf(manifest, worker.id) !== void 0,
 				serviceName: worker.name,
 				...telemetryValues ? { telemetry: telemetryValues } : {}
 			}),
+			...push ? { [SUBSCRIBER_PUSH_URL_KEY]: push.url } : {},
 			NODE_ENV: "production",
 			PORT: String(worker.port),
 			STAGE: stage
@@ -1641,6 +1659,17 @@ function composeStack(input) {
 			health: app.kind === "site" ? "/" : "/health"
 		})),
 		...[...fileServers.values()].map(({ route }) => route),
+		...workers.flatMap(({ name, port, push }) => push ? [{
+			name,
+			host: push.host,
+			upstreams: [{
+				service: name,
+				port
+			}],
+			streaming: false,
+			paths: push.paths,
+			health: "/health"
+		}] : []),
 		...logs?.host && logs.public ? [{
 			name: require_seeds.LOGS_SERVICE,
 			host: logs.host,
@@ -1652,6 +1681,7 @@ function composeStack(input) {
 			allow: logs.public.allow
 		}] : []
 	];
+	assertHostsUnique(routes);
 	const dockerfiles = {};
 	for (const app of apps) {
 		if (!app.build) continue;
@@ -1746,6 +1776,51 @@ function stackApps(workspace, manifest, plan, options) {
 	}
 	return apps.sort((a, b) => a.name.localeCompare(b.name));
 }
+/** What the worker reads the public base of its push routes from. */
+const SUBSCRIBER_PUSH_URL_KEY = "GKM_SUBSCRIBER_PUSH_URL";
+/**
+* Where SNS pushes to a worker on a deployed stage, or nothing when it pushes
+* to none of its subscribers.
+*
+* A subscriber is pushed to when its topic's connection string, as this stage
+* resolved it for the worker, is an SNS one — the same test the worker's own
+* startup makes, so the edge exposes a route exactly when the worker mounts
+* it. Each such route, and nothing else the worker serves, answers on
+* `<worker>.<domain>`.
+*/
+function workerPush(worker, subscribers, env, options) {
+	const paths = subscribers.filter(({ topic }) => env[(0, _geekmidas_manifest.provideKey)(topic, "publisherConnectionString")]?.startsWith("sns:")).map(({ name }) => require_SubscriberGenerator.subscriberRoute(name)).sort();
+	if (paths.length === 0) return void 0;
+	if (!options.domain) throw new require_seeds.NoDomainForStage(options.stage);
+	const host = `${worker.name}.${options.domain}`;
+	return {
+		host,
+		url: `https://${host}`,
+		paths: [...new Set(paths)]
+	};
+}
+/** Two constructs the edge would answer on one host. */
+var EdgeHostTaken = class extends require_errors.GkmError {
+	host;
+	first;
+	second;
+	constructor(host, first, second) {
+		super(`'${first}' and '${second}' would both answer on ${host}, and the edge can send a host to only one of them. Give one a subdomain of its own, or rename it.`);
+		this.host = host;
+		this.first = first;
+		this.second = second;
+		this.name = "EdgeHostTaken";
+	}
+};
+/** Refuse a stack where one host would be routed to two services. */
+function assertHostsUnique(routes) {
+	const claimed = /* @__PURE__ */ new Map();
+	for (const { host, name } of routes) {
+		const first = claimed.get(host);
+		if (first !== void 0) throw new EdgeHostTaken(host, first, name);
+		claimed.set(host, name);
+	}
+}
 /** Each worker's image, and where it is built from. */
 function stackWorkers(units, options) {
 	return units.map((unit) => ({
@@ -1852,7 +1927,7 @@ function stackFile(options) {
 		restart: "unless-stopped",
 		ports: [`${options.https}:443`, `${options.http}:80`],
 		volumes: ["caddy-data:/data", "caddy-config:/config"],
-		depends_on: Object.fromEntries(apps.map((app) => [app.name, HEALTHY])),
+		depends_on: Object.fromEntries([...apps.map((app) => app.name), ...options.workers.filter((w) => w.push).map((w) => w.name)].map((name) => [name, HEALTHY])),
 		healthcheck: {
 			test: [
 				"CMD",
@@ -2307,11 +2382,13 @@ async function validateCompose(ctx, deps, options = {}) {
 	if (!registry && (push || mode === "pull")) throw new RegistryRequired(push ? "push" : "pull", require_identity.imageRef(identity, ctx.apps[0] ?? workspace.name, void 0, tag));
 	const runnables = {};
 	const background = {};
+	const subscribers = {};
 	const manifest = await require_discover.discover({
 		patterns: require_seeds.constructGlobs(workspace),
 		cwd: root,
 		runnables,
-		background
+		background,
+		subscribers
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
 	const layout = mode === "build" ? require_seeds.imageLayout(workspace) : void 0;
@@ -2320,6 +2397,7 @@ async function validateCompose(ctx, deps, options = {}) {
 		manifest,
 		runnables,
 		background,
+		subscribers,
 		stage,
 		identity,
 		images: {
@@ -2652,7 +2730,11 @@ async function prepareBuckets(ctx, run, deps) {
 	let done;
 	try {
 		const client = deps.buckets(tunnel.port, storage);
-		done = [...await require_seeds.applyBuckets(client, storage.buckets), ...await require_seeds.applyPolicies(client, storage.policies)];
+		done = [
+			...await require_seeds.applyBuckets(client, storage.buckets),
+			...await require_seeds.applyPolicies(client, storage.policies),
+			...await require_seeds.applyLifecycles(client, storage.lifecycles)
+		];
 	} finally {
 		await tunnel.close();
 	}
@@ -3342,4 +3424,4 @@ Object.defineProperty(exports, "stackPlan", {
 	}
 });
 
-//# sourceMappingURL=compose-JOasAHcd.cjs.map
+//# sourceMappingURL=compose-tZLAZZp6.cjs.map