@geekmidas/cli 10.0.0-alpha.124 → 10.0.0-alpha.125

package/dist/{compose-BfXXWJSp.cjs → compose-Bqcy0lqo.cjs}

@@ -1,15 +1,15 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_credentials = require("./credentials-D7XJypNd.cjs");
-const require_workspace = require("./workspace-C82GLPnf.cjs");
-const require_snsSubscriptions = require("./snsSubscriptions-CSkteK2J.cjs");
+const require_workspace = require("./workspace-Du4Afb03.cjs");
+const require_snsSubscriptions = require("./snsSubscriptions-5Cqww8S7.cjs");
 const require_define = require("./define-crmMcXFS.cjs");
-const require_seeds = require("./seeds-DOfxmDRO.cjs");
+const require_seeds = require("./seeds-CPEcmoPn.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-C3QTae-R.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-BDUp7OeY.cjs");
 const require_identity = require("./identity-CbLfgQNT.cjs");
-const require_discover = require("./discover-ojkcbxHw.cjs");
-const require_drivers = require("./drivers-CQ32PB5w.cjs");
+const require_discover = require("./discover-DL6h-J97.cjs");
+const require_drivers = require("./drivers-L29WvE95.cjs");
 const require_databases = require("./databases-fOaoBInm.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -649,6 +649,21 @@ const sshAccess = {
 	}
 };
 //#endregion
+//#region src/compose/routes.ts
+/** A route with handlers and a check that would have to hold for each of them. */
+var EdgeRouteConflict = class extends Error {
+	route;
+	constructor(route) {
+		super(`The edge route '${route}' sends some paths to other upstreams and also restricts who or what it answers. The two are not combined: give the restricted paths a host of their own.`);
+		this.route = route;
+		this.name = "EdgeRouteConflict";
+	}
+};
+/** @throws {EdgeRouteConflict} */
+function assertRouteRenderable(route) {
+	if (route.handlers?.length && (route.allow || route.paths || route.prefixes || route.requireHeader)) throw new EdgeRouteConflict(route.name);
+}
+//#endregion
 //#region src/compose/caddyfile.ts
 /**
 * The stack's own edge, rendered for Caddy: one site block per route.
@@ -684,26 +699,55 @@ function edgeCaddyfile(routes, options) {
 ` : tls.kind === "files" ? `
 	tls ${tls.certFile} ${tls.keyFile}
 ` : "";
-	const blocks = routes.map(({ host, upstreams, prefix, allow, auth, paths, streaming }) => `https://${host} {${certificate}
-	# gkm's own header, which only a service of this stack may send: the auth
-	# server rate-limits by the client address it carries.
-	request_header -${_geekmidas_manifest.CLIENT_IP_HEADER}
-${allow ? `
+	const blocks = routes.map((route) => siteBlock(route, certificate));
+	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
+}
+/** One route's site block. */
+function siteBlock(route, certificate) {
+	assertRouteRenderable(route);
+	const { host, allow, auth, paths, prefixes, requireHeader, handlers } = route;
+	const allowed = [...paths ?? [], ...(prefixes ?? []).map((prefix) => `${prefix}*`)];
+	const checks = `${allow ? `
 	# Only these addresses — the peer Caddy sees, never a header a client
 	# could set. Everything else is refused before it reaches the upstream.
 	@denied not remote_ip ${allow.join(" ")}
 	respond @denied 403
+` : ""}${requireHeader ? `
+	# Only what the CDN sends: it adds this header to every request, and this
+	# host would be reached around the CDN otherwise.
+	@forged not header ${requireHeader.name} "${requireHeader.value}"
+	respond @forged 403
 ` : ""}${auth ? `
 	# The stage's login, asked for before anything reaches the upstream.
 	basic_auth {
 		${auth.user} ${auth.hash}
 	}
-` : ""}${paths ? `
+` : ""}${allowed.length ? `
 	# Only these paths answer. Everything else on this host is refused before
 	# it reaches the upstream.
-	@elsewhere not path ${paths.join(" ")}
+	@elsewhere not path ${allowed.join(" ")}
 	respond @elsewhere 404
-` : ""}${prefix ? `
+` : ""}`;
+	const proxy = proxyBlock(route);
+	const body = handlers?.length ? `${handlers.map((handler, index) => `
+	# Answered by another service: ${handler.name}.
+	@handler${index} path ${handler.prefixes.map((prefix) => `${prefix}*`).join(" ")}
+	handle @handler${index} {
+		reverse_proxy ${handler.upstreams.map(address).join(" ")}
+	}
+`).join("")}
+	handle {${proxy.replace(/\n/g, "\n	")}
+	}` : proxy;
+	return `https://${host} {${certificate}
+	# gkm's own header, which only a service of this stack may send: the auth
+	# server rate-limits by the client address it carries.
+	request_header -${_geekmidas_manifest.CLIENT_IP_HEADER}
+${checks}${body}
+}`;
+}
+/** Where a route's requests go, when no handler took them. */
+function proxyBlock({ upstreams, prefix, streaming }) {
+	return prefix ? `
 	# A bucket, served at a host of its own: the bucket is a prefix on MinIO,
 	# which routes and signs on the Host header — so it is sent the upstream's.
 	reverse_proxy ${upstreams.map(address).join(" ")} {
@@ -716,17 +760,16 @@ ${allow ? `
 		# Never buffer: a streamed response — server-sent events, a Next.js
 		# RSC payload — reaches the client as each chunk is written.
 		flush_interval -1
-	}` : ""}`}
-}`);
-	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
+	}` : ""}`;
 }
 const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
 #
 # One host per API and site, each in front of its own container, one per
-# file server in front of the stack's MinIO, one per worker SNS pushes to,
-# answering only those routes, and — when its logs are served publicly — one
-# for OpenObserve, to the addresses it allows. A site the stage puts behind a
-# password asks for its login first.
+# file server in front of the stack's MinIO — its processors' paths sent to
+# their own service — one per worker SNS pushes to and per processor unit a
+# CDN reaches, answering only those paths, and — when its logs are served
+# publicly — one for OpenObserve, to the addresses it allows. A site the
+# stage puts behind a password asks for its login first.
 `;
 //#endregion
 //#region src/compose/images.ts
@@ -1029,9 +1072,24 @@ function traefikDynamic(routes, options) {
 			middlewares[name(route, "prefix")] = { addPrefix: { prefix: route.prefix } };
 			chain.push(name(route, "prefix"));
 		}
-		const paths = route.paths ? ` && (${route.paths.map((path) => `Path(\`${path}\`)`).join(" || ")})` : "";
+		assertRouteRenderable(route);
+		const allowed = [...(route.paths ?? []).map((path) => `Path(\`${path}\`)`), ...(route.prefixes ?? []).map((prefix) => `PathPrefix(\`${prefix}\`)`)];
+		const paths = allowed.length ? ` && (${allowed.join(" || ")})` : "";
+		const header = route.requireHeader ? ` && Header(\`${route.requireHeader.name}\`, \`${route.requireHeader.value}\`)` : "";
+		for (const handler of route.handlers ?? []) {
+			const handlerName = name(route, handler.name);
+			routers[handlerName] = {
+				rule: `Host(\`${route.host}\`) && (${handler.prefixes.map((prefix) => `PathPrefix(\`${prefix}\`)`).join(" || ")})`,
+				priority: 1e4,
+				entryPoints: ["websecure"],
+				service: handlerName,
+				middlewares: [strip],
+				tls: tls.kind === "acme" ? { certResolver: ACME_RESOLVER } : {}
+			};
+			services[handlerName] = { loadBalancer: { servers: handler.upstreams.map((upstream) => ({ url: url(upstream) })) } };
+		}
 		routers[name(route)] = {
-			rule: `Host(\`${route.host}\`)${paths}`,
+			rule: `Host(\`${route.host}\`)${paths}${header}`,
 			entryPoints: ["websecure"],
 			service: name(route),
 			middlewares: chain,
@@ -1173,6 +1231,19 @@ const LOG_ROTATION = {
 		"max-file": "3"
 	}
 };
+/** A CDN serves the bucket, and the secret it sends the processors is not in the stage. */
+var ProcessorOriginSecretMissing = class extends require_errors.GkmError {
+	fileServer;
+	key;
+	stage;
+	constructor(fileServer, key, stage) {
+		super(`'${fileServer}' has processors, and its bucket is not the stack's MinIO, so they are reached through the CDN in front of it — which sends ${key}, and stage '${stage}' has none. It is written by the deploy that creates the CDN (\`deploy.objects.${stage}\` on s3, cdn on): run gkm deploy --stage ${stage}.`);
+		this.fileServer = fileServer;
+		this.key = key;
+		this.stage = stage;
+		this.name = "ProcessorOriginSecretMissing";
+	}
+};
 /**
 * The stack with Caddy's files inline: its Caddyfile and, where the stage has
 * one, its own certificate — `configs` with their `content`, which compose
@@ -1381,7 +1452,13 @@ function composeStack(input) {
 		identity,
 		images: input.images
 	});
-	if (apps.length === 0 && workers.length === 0) throw new NothingToCompose(workspace.root);
+	const processors = stackProcessors(require_seeds.processorUnits(workspace, manifest), {
+		manifest,
+		stage,
+		identity,
+		images: input.images
+	});
+	if (apps.length === 0 && workers.length === 0 && processors.length === 0) throw new NothingToCompose(workspace.root);
 	const owners = /* @__PURE__ */ new Map();
 	for (const resource of plan.resources) {
 		owners.set(resource.envKey, resource);
@@ -1633,6 +1710,48 @@ function composeStack(input) {
 		};
 		for (const [key, value] of Object.entries(worker.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(worker.name, key);
 	}
+	for (const unit of processors) {
+		const served = fileServers.get(unit.id);
+		if (served) served.route = {
+			...served.route,
+			handlers: [{
+				name: unit.name,
+				prefixes: unit.prefixes,
+				upstreams: [{
+					service: unit.name,
+					port: unit.port
+				}]
+			}]
+		};
+		else if (!local && !input.buildOnly) {
+			if (!domain) throw new require_seeds.NoDomainForStage(stage);
+			const key = require_seeds.originSecretKey(unit.id);
+			const secret = custom[key];
+			if (!secret) throw new ProcessorOriginSecretMissing(unit.id, key, stage);
+			unit.origin = {
+				host: require_seeds.processorOriginHost(unit.id, domain),
+				secret
+			};
+		}
+		if (proxy === "traefik" && (served || unit.origin)) edgeServices.add(unit.name);
+		if (input.buildOnly) continue;
+		const keys = require_seeds.processorEnvKeys(manifest, unit.id, input.runnables) ?? /* @__PURE__ */ new Set();
+		unit.env = {
+			...require_seeds.scopeTelemetryEnv(valuesFor({
+				name: unit.name,
+				id: unit.id,
+				kind: "rest-api"
+			}, keys), {
+				uses: require_seeds.telemetryOf(manifest, unit.id) !== void 0,
+				serviceName: unit.name,
+				...telemetryValues ? { telemetry: telemetryValues } : {}
+			}),
+			NODE_ENV: "production",
+			PORT: String(unit.port),
+			STAGE: stage
+		};
+		for (const [key, value] of Object.entries(unit.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(unit.name, key);
+	}
 	if (storage && !input.buildOnly) {
 		const watched = require_seeds.watchedBuckets(manifest, input.subscribers ?? {});
 		for (const [bucket, workerId] of watched) {
@@ -1675,6 +1794,7 @@ function composeStack(input) {
 		infra,
 		apps,
 		workers,
+		processors,
 		credentials: credential.containers,
 		...storage ? { storage } : {},
 		...logs ? { logs } : {},
@@ -1710,6 +1830,21 @@ function composeStack(input) {
 			health: app.kind === "site" ? "/" : "/health"
 		})),
 		...[...fileServers.values()].map(({ route }) => route),
+		...processors.flatMap(({ name, port, prefixes, origin }) => origin ? [{
+			name,
+			host: origin.host,
+			upstreams: [{
+				service: name,
+				port
+			}],
+			streaming: false,
+			prefixes,
+			requireHeader: {
+				name: require_seeds.ORIGIN_VERIFY_HEADER,
+				value: origin.secret
+			},
+			health: "/health"
+		}] : []),
 		...workers.flatMap(({ name, port, push }) => push ? [{
 			name,
 			host: push.host,
@@ -1759,12 +1894,26 @@ function composeStack(input) {
 			cache: require_seeds.STACK_CACHE
 		});
 	}
+	for (const unit of processors) {
+		if (!unit.build) continue;
+		dockerfiles[unit.build.dockerfile] = require_seeds.processorDockerfile({
+			id: unit.id,
+			name: unit.name,
+			app: unit.host
+		}, workspace.apps[unit.host], {
+			layout,
+			workspaceRoot: workspace.root,
+			native: unit.native,
+			cache: require_seeds.STACK_CACHE
+		});
+	}
 	return {
 		project,
 		stage,
 		local,
 		apps,
 		workers,
+		processors,
 		mobileApps,
 		infra,
 		compose,
@@ -1904,6 +2053,25 @@ function assertHostsUnique(routes) {
 		claimed.set(host, name);
 	}
 }
+/** Each processor unit's image, and where it is built from. */
+function stackProcessors(units, options) {
+	return units.map((unit) => {
+		const server = options.manifest[unit.id];
+		const processors = server?.kind === "file-server" ? server.processors ?? [] : [];
+		return {
+			app: unit.name,
+			name: unit.name,
+			id: unit.id,
+			host: unit.app,
+			port: require_seeds.PROCESSOR_PORT,
+			prefixes: [...new Set(processors.map((p) => p.prefix))].sort(),
+			native: require_seeds.processorNative(options.manifest, unit.id),
+			ref: require_seeds.validateImageRef(require_identity.imageRef(options.identity, unit.name, options.images.registry, options.images.tag)),
+			tag: options.images.tag,
+			...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${unit.name}` } } : {}
+		};
+	});
+}
 /** Each worker's image, and where it is built from. */
 function stackWorkers(units, options) {
 	return units.map((unit) => ({
@@ -1990,7 +2158,7 @@ function stackFile(options) {
 		} : {},
 		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
 	};
-	for (const worker of options.workers) services[worker.name] = {
+	for (const worker of [...options.workers, ...options.processors]) services[worker.name] = {
 		image: worker.ref,
 		...worker.build ? { build: require_seeds.composeBuildPaths({
 			composeDir: options.composeDir,
@@ -2011,7 +2179,11 @@ function stackFile(options) {
 		restart: "unless-stopped",
 		ports: [`${options.https}:443`, `${options.http}:80`],
 		volumes: ["caddy-data:/data", "caddy-config:/config"],
-		depends_on: Object.fromEntries([...apps.map((app) => app.name), ...options.workers.filter((w) => w.push).map((w) => w.name)].map((name) => [name, HEALTHY])),
+		depends_on: Object.fromEntries([
+			...apps.map((app) => app.name),
+			...options.workers.filter((w) => w.push).map((w) => w.name),
+			...options.processors.map((p) => p.name)
+		].map((name) => [name, HEALTHY])),
 		healthcheck: {
 			test: [
 				"CMD",
@@ -2632,7 +2804,11 @@ async function validateCompose(ctx, deps, options = {}) {
 	if (mode === "build") assertRedisClient(workspace, composed, manifest, runnables);
 	const pinned = (unpinned) => options.pin ? withPinnedImages(unpinned, options.pin.file, options.pin.digests) : unpinned;
 	const stack = pinned(composed);
-	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
+	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [
+		...stack.apps,
+		...stack.workers,
+		...stack.processors
+	]);
 	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
 		ctx.secrets.mask(stack.logs.password);
@@ -2838,8 +3014,13 @@ async function stageSecrets(ctx, manifest) {
 function withPinnedImages(stack, file, digests) {
 	const apps = pinImages(file, digests, stack.apps);
 	const workers = pinImages(file, digests, stack.workers);
+	const processors = pinImages(file, digests, stack.processors);
 	const services = { ...stack.compose.services };
-	for (const image of [...apps, ...workers]) services[image.name] = {
+	for (const image of [
+		...apps,
+		...workers,
+		...processors
+	]) services[image.name] = {
 		...services[image.name],
 		image: image.ref
 	};
@@ -2847,6 +3028,7 @@ function withPinnedImages(stack, file, digests) {
 		...stack,
 		apps,
 		workers,
+		processors,
 		compose: {
 			...stack.compose,
 			services
@@ -2895,7 +3077,7 @@ async function planCompose(ctx, run) {
 			action: run.previous[app.name] ? "reuse" : "create"
 		});
 	}
-	for (const worker of run.stack.workers) {
+	for (const worker of [...run.stack.workers, ...run.stack.processors]) {
 		planned({
 			key: `image:${worker.name}`,
 			resourceType: "image",
@@ -3131,7 +3313,11 @@ async function migrateAndSeed(ctx, run, deps, port) {
 */
 async function buildCompose(ctx, run, deps) {
 	const { stack, ref } = run;
-	const images = [...stack.apps, ...stack.workers];
+	const images = [
+		...stack.apps,
+		...stack.workers,
+		...stack.processors
+	];
 	const apps = images.map((image) => image.app);
 	if (run.push) {
 		run.files = await writeStack(ctx.cwd, run.dir, stack);
@@ -3203,7 +3389,7 @@ async function releaseCompose(ctx, run, deps) {
 			url: app.url
 		});
 	}
-	for (const worker of stack.workers) applied(ctx, run, {
+	for (const worker of [...stack.workers, ...stack.processors]) applied(ctx, run, {
 		key: `service:${worker.name}`,
 		resourceType: "service",
 		action: "ensure",
@@ -3213,6 +3399,7 @@ async function releaseCompose(ctx, run, deps) {
 	ctx.logger.info(`\n✅ ${stack.project} is running:`);
 	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}${app.auth ? `  🔒 user: ${app.auth.user}, password: gkm secrets:show --stage ${ctx.stage} --reveal → ${app.auth.key}` : ""}`);
 	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} worker ${worker.id}`);
+	for (const unit of stack.processors) ctx.logger.info(`   ${unit.name.padEnd(12)} processors of ${unit.id}`);
 	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${(0, node_path.join)(stackDir(ctx.stage), "caddy-root.crt")}`);
 }
 /**
@@ -3223,7 +3410,11 @@ async function releaseCompose(ctx, run, deps) {
 async function recordImages(ctx, run) {
 	const journal = await require_seeds.DeployJournal.open(ctx.state, ctx.stage, () => require_seeds.createComposeState(ctx.stage));
 	const by = require_seeds.currentActor();
-	for (const app of [...run.stack.apps, ...run.stack.workers]) {
+	for (const app of [
+		...run.stack.apps,
+		...run.stack.workers,
+		...run.stack.processors
+	]) {
 		const image = run.images[app.app] ?? {
 			ref: app.ref,
 			tag: app.tag
@@ -3252,7 +3443,7 @@ async function verifyCompose(ctx, run, deps) {
 		ca,
 		edge
 	})));
-	results.push(...await Promise.all(stack.workers.map((worker) => checkContainer(ctx, run, deps, worker.name))));
+	results.push(...await Promise.all([...stack.workers, ...stack.processors].map((worker) => checkContainer(ctx, run, deps, worker.name))));
 	if (stack.logs) results.push(await checkContainer(ctx, run, deps, require_seeds.LOGS_SERVICE));
 	const down = results.filter((result) => !result.healthy).map(({ app, url, last }) => ({
 		app,
@@ -3417,7 +3608,7 @@ function composeResult(ctx, run) {
 			...image?.digest ? { digest: image.digest } : {},
 			url: app.url
 		};
-	}), ...run.stack.workers.map((worker) => {
+	}), ...[...run.stack.workers, ...run.stack.processors].map((worker) => {
 		const image = run.images[worker.name];
 		return {
 			appName: worker.name,
@@ -3491,7 +3682,11 @@ async function writeStack(root, dir, stack) {
 		recursive: true,
 		force: true
 	});
-	for (const app of [...stack.apps, ...stack.workers]) if (app.env) await write((0, node_path.join)(dir, `${app.name}.env`), envFile(app.env), 384);
+	for (const app of [
+		...stack.apps,
+		...stack.workers,
+		...stack.processors
+	]) if (app.env) await write((0, node_path.join)(dir, `${app.name}.env`), envFile(app.env), 384);
 	if (stack.logs && stack.compose.services["openobserve"]?.env_file) await write((0, node_path.join)(dir, `${require_seeds.LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
 	if (stack.redis && stack.compose.services["redis"]?.env_file) await write((0, node_path.join)(dir, `${require_seeds.REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
 	if (stack.backups) {
@@ -3529,6 +3724,7 @@ function printPlan(ctx, run) {
 	if (run.server) ctx.logger.info(`   → ${sshTarget(run.server)} (docker over ssh)`);
 	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url.padEnd(40)} ${mode} ${app.ref}`);
 	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} ${`worker ${worker.id} (no route)`.padEnd(40)} ${mode} ${worker.ref}`);
+	for (const unit of stack.processors) ctx.logger.info(`   ${unit.name.padEnd(12)} ${`processors of ${unit.id}`.padEnd(40)} ${mode} ${unit.ref}`);
 	if (stack.infra.length > 0) ctx.logger.info(`   infrastructure: ${stack.infra.join(", ")}`);
 	if (stack.backups) ctx.logger.info(`   ${require_snsSubscriptions.BACKUPS_SERVICE.padEnd(12)} ${stack.backups.databases.map((d) => d.file).join(", ")} — ${stack.backups.backups.describe}, to ${stack.backups.prefix}/`);
 	ctx.logger.info(`\n📝 Wrote ${files.length} file(s) under ${stackDir(stack.stage)}/`);
@@ -3750,4 +3946,4 @@ Object.defineProperty(exports, "stackPlan", {
 	}
 });
 
-//# sourceMappingURL=compose-BfXXWJSp.cjs.map
+//# sourceMappingURL=compose-Bqcy0lqo.cjs.map