@geekmidas/cli 10.0.0-alpha.126 → 10.0.0-alpha.127

package/dist/{compose-CvHIjMDd.mjs → compose-CIzCcsoz.mjs}

@@ -2,14 +2,14 @@ import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { c as runOutput, s as run } from "./credentials-DpfnUvIR.mjs";
 import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, it as ComposeTlsFileMissing, ot as proxyFor, z as telemetryEnv } from "./workspace-DBHF9Gba.mjs";
-import { A as backupsRoleStatements, C as passwordSites, D as BACKUPS_SERVICE, E as withSitePasswords, M as stackBackups, R as stageBackups, T as siteNames, a as subscriptionKey, c as HostNotPointingAtServer, f as requiredServerAddress, g as stageDns, h as stackHosts, i as recordedPushSubscriptions, j as backupsService, n as SUBSCRIPTION_TYPE, o as subscriptionResource, p as serverAddressHint, r as confirmPendingSubscriptions, s as topicConnection, t as PushSubscriptionsUnconfirmed, u as isLocalHost, v as systemLookup, w as siteAuth } from "./snsSubscriptions-R_AKBZYK.mjs";
+import { A as backupsRoleStatements, C as passwordSites, D as BACKUPS_SERVICE, E as withSitePasswords, M as stackBackups, R as stageBackups, T as siteNames, a as subscriptionKey, c as HostNotPointingAtServer, f as requiredServerAddress, g as stageDns, h as stackHosts, i as recordedPushSubscriptions, j as backupsService, n as SUBSCRIPTION_TYPE, o as subscriptionResource, p as serverAddressHint, r as confirmPendingSubscriptions, s as topicConnection, t as PushSubscriptionsUnconfirmed, u as isLocalHost, v as systemLookup, w as siteAuth } from "./snsSubscriptions-BxLJQH4u.mjs";
 import { t as defineTarget } from "./define-6poNqm5O.mjs";
-import { $ as ORIGIN_VERIFY_HEADER, $n as telemetryOf, An as postgresSuperuser, At as LEGACY_LOCAL_LOGIN, B as processorDockerfile, Bn as redisService, Ct as backendsOf, Dn as LOCAL_RABBITMQ_USER, Ft as composeFor, Gn as localRolePassword, H as workerDockerfile, Hn as stackRedis, L as appDockerfile, Ln as withGeneratedSecrets, Mt as bucketClient, N as stageProviderNotes, Nt as pgClient, On as loadLocalCredentials, Qt as initStageSecrets, Rn as REDIS_SERVICE, S as recordRelease, Sn as bucketPolicies, Un as withRedisPassword, V as processorNative, Vn as runsRedis, Wn as envFor, Xn as isTelemetryKey, Zn as scopeTelemetryEnv, _n as applyLifecycles, _r as withLogsPassword, _t as appEnvKeys, a as dnsResources, an as PROCESSOR_PORT, ar as DEFAULT_IMAGES, bn as applyPostgres, br as resolveHost, bt as processorEnvKeys, c as currentActor, cr as portKeys, d as DeployJournal, dr as primaryPortKey, dt as devServicesUsed, er as usesTelemetry, fn as publicBuildValues, ft as externalServices, gn as applyBuckets, gr as stackLogs, gt as suppliedOnly, hn as workerUnits, hr as logsService, ht as stageServiceDeclarations, in as imageLayout, ir as hostFor, it as validateImageRef, jt as ensurePostgresLogin, ln as findBuildRoot, mn as processorUnits, mr as logsAccess, n as reportDatabaseRuns, nr as watchedBuckets, nt as originSecretKey, o as forgetDnsResource, on as TURBO_VERSION, pr as LOGS_SERVICE, qn as planFor, r as reportPlannedSeeds, rn as composeBuildPaths, rr as EMULATOR_ACCESS_KEY_ID, rt as processorOriginHost, s as recordDnsChanges, sn as WORKER_PORT, t as DeploySeedsFailed, tr as minioWebhookEnv, v as createComposeState, vn as applyNotifications, vr as NoDomainForStage, wn as postgresStatements, wt as constructGlobs, xn as bucketLifecycles, xt as workerEnvKeys, yn as applyPolicies, yr as isMainFrontendApp, yt as networkEnv, z as ensureDockerignore, zn as STACK_CACHE } from "./seeds-Cfejy8wj.mjs";
-import { t as appKey } from "./derive-B4vDpzgP.mjs";
+import { $ as ORIGIN_VERIFY_HEADER, $n as telemetryOf, An as postgresSuperuser, At as LEGACY_LOCAL_LOGIN, B as processorDockerfile, Bn as redisService, Ct as backendsOf, Dn as LOCAL_RABBITMQ_USER, Ft as composeFor, Gn as localRolePassword, H as workerDockerfile, Hn as stackRedis, L as appDockerfile, Ln as withGeneratedSecrets, Mt as bucketClient, N as stageProviderNotes, Nt as pgClient, On as loadLocalCredentials, Qt as initStageSecrets, Rn as REDIS_SERVICE, S as recordRelease, Sn as bucketPolicies, Un as withRedisPassword, V as processorNative, Vn as runsRedis, Wn as envFor, Xn as isTelemetryKey, Zn as scopeTelemetryEnv, _n as applyLifecycles, _r as withLogsPassword, _t as appEnvKeys, a as dnsResources, an as PROCESSOR_PORT, ar as DEFAULT_IMAGES, bn as applyPostgres, br as resolveHost, bt as processorEnvKeys, c as currentActor, cr as portKeys, d as DeployJournal, dr as primaryPortKey, dt as devServicesUsed, er as usesTelemetry, fn as publicBuildValues, ft as externalServices, gn as applyBuckets, gr as stackLogs, gt as suppliedOnly, hn as workerUnits, hr as logsService, ht as stageServiceDeclarations, in as imageLayout, ir as hostFor, it as validateImageRef, jt as ensurePostgresLogin, ln as findBuildRoot, mn as processorUnits, mr as logsAccess, n as reportDatabaseRuns, nr as watchedBuckets, nt as originSecretKey, o as forgetDnsResource, on as TURBO_VERSION, pr as LOGS_SERVICE, qn as planFor, r as reportPlannedSeeds, rn as composeBuildPaths, rr as EMULATOR_ACCESS_KEY_ID, rt as processorOriginHost, s as recordDnsChanges, sn as WORKER_PORT, t as DeploySeedsFailed, tr as minioWebhookEnv, v as createComposeState, vn as applyNotifications, vr as NoDomainForStage, wn as postgresStatements, wt as constructGlobs, xn as bucketLifecycles, xt as workerEnvKeys, yn as applyPolicies, yr as isMainFrontendApp, yt as networkEnv, z as ensureDockerignore, zn as STACK_CACHE } from "./seeds-BX9pskrU.mjs";
+import { t as appKey } from "./derive-Dew0QoGe.mjs";
 import { i as installedFrom, s as DEFAULT_EVENTS } from "./drivers-CDjpjakg.mjs";
 import { a as imageRef } from "./identity-CBXr4wNi.mjs";
-import { i as discover } from "./discover-CzGM5P3p.mjs";
-import { a as SNS_SUBSCRIPTIONS_KEY, o as objectsRoute, s as subscriberRoute } from "./SubscriberGenerator-BALddfuW.mjs";
+import { i as discover } from "./discover-DOhYSKY_.mjs";
+import { a as SNS_SUBSCRIPTIONS_KEY, o as objectsRoute, s as subscriberRoute } from "./SubscriberGenerator-0ruEmYXj.mjs";
 import { f as plannedSeeds, o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "./databases-6GD0tI2F.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
@@ -663,6 +663,21 @@ var EdgeRouteConflict = class extends Error {
 function assertRouteRenderable(route) {
 	if (route.handlers?.length && (route.allow || route.paths || route.prefixes || route.requireHeader)) throw new EdgeRouteConflict(route.name);
 }
+/** File descriptors a process holding sockets may open. */
+const NOFILE = {
+	soft: 1048576,
+	hard: 1048576
+};
+/**
+* What the edge runs with: a descriptor per socket, twice — the client's and
+* the upstream's — and every local port for those upstream connections. One
+* edge address to one upstream has only the ephemeral range to open
+* connections from, ~28k by Linux's default; widened, ~64k per replica.
+*/
+const EDGE_LIMITS = {
+	sysctls: { "net.ipv4.ip_local_port_range": "1024 65535" },
+	ulimits: { nofile: NOFILE }
+};
 //#endregion
 //#region src/compose/caddyfile.ts
 /**
@@ -1023,6 +1038,7 @@ function edgeCompose(options) {
 			],
 			labels: { "dev.geekmidas.edge.config": createHash("sha256").update(options.staticConfig).digest("hex").slice(0, 16) },
 			networks: ["edge"],
+			...EDGE_LIMITS,
 			healthcheck: {
 				test: [
 					"CMD",
@@ -1467,6 +1483,7 @@ function composeStack(input) {
 			owners.set(provideKey(resource.id, "inboxUrl"), resource);
 		}
 		if (resource.kind === "external-api") owners.set(provideKey(resource.id, "credentials"), resource);
+		if (resource.kind === "websocket-api") owners.set(provideKey(resource.id, "publisherConnectionString"), resource);
 	}
 	const domain = workspace.domains?.[stage];
 	const telemetry = resolveStageTelemetry({
@@ -1562,7 +1579,7 @@ function composeStack(input) {
 		});
 	}
 	const edgeServices = new Set(proxy === "traefik" ? [
-		...apps.map((app) => app.name),
+		...apps.flatMap(replicaNames),
 		...fileServers.size > 0 ? ["minio"] : [],
 		...logsBase?.host && logsBase.public ? [LOGS_SERVICE] : []
 	] : []);
@@ -1587,9 +1604,9 @@ function composeStack(input) {
 	}, hostOf);
 	const inside = networkEnv(plan, {
 		...derivation,
-		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${hostOf(app.name)}:${app.port}`]))
+		addresses: Object.fromEntries(apps.map((app) => [app.id, `${app.kind === "websocket-api" ? "ws" : "http"}://${hostOf(app.name)}:${app.port}`]))
 	}, hostOf);
-	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
+	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "websocket-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
 	const appById = new Map(apps.map((app) => [app.id, app]));
 	/**
 	* What a key resolves to for one app, from the stage's secrets where only
@@ -1615,8 +1632,9 @@ function composeStack(input) {
 		}
 		if (custom[key] !== void 0) return custom[key];
 		if (owner?.kind === "cache") return redis?.urls[key];
+		if (owner?.kind === "websocket-api" && key === provideKey(owner.id, "publisherConnectionString")) return redis?.urls[key];
 		const surface = surfaceUrls.get(key);
-		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
+		if ((app.kind === "rest-api" || app.kind === "websocket-api") && surface && surface !== app.id) return inside[key];
 		return outside[key];
 	};
 	const telemetryValues = logs ? telemetryEnv({
@@ -1652,7 +1670,7 @@ function composeStack(input) {
 		const values = valuesFor(app, keys);
 		const trusted = provideKey(app.id, "trustedOrigins");
 		if (keys.has(trusted)) {
-			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${hostOf(caller.name)}:${caller.port}`);
+			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api" || caller?.kind === "websocket-api").map((caller) => `http://${hostOf(caller.name)}:${caller.port}`);
 			const origins = [...(values[trusted] ?? "").split(",").filter(Boolean), ...internal];
 			values[trusted] = [...new Set(origins)].join(",");
 		}
@@ -1818,10 +1836,10 @@ function composeStack(input) {
 		...apps.map((app) => ({
 			name: app.name,
 			host: app.host,
-			upstreams: [{
-				service: app.name,
+			upstreams: replicaNames(app).map((service) => ({
+				service,
 				port: app.port
-			}],
+			})),
 			streaming: true,
 			...app.auth ? { auth: {
 				user: app.auth.user,
@@ -1952,7 +1970,7 @@ function stackApps(workspace, manifest, plan, options) {
 	const apps = [];
 	const resources = new Map(plan.resources.map((r) => [r.id, r]));
 	for (const [id, declaration] of Object.entries(manifest)) {
-		if (declaration.kind !== "rest-api" && declaration.kind !== "site") continue;
+		if (declaration.kind !== "rest-api" && declaration.kind !== "websocket-api" && declaration.kind !== "site") continue;
 		const name = appKey(id);
 		const app = workspace.apps[name];
 		const resource = resources.get(id);
@@ -1965,10 +1983,11 @@ function stackApps(workspace, manifest, plan, options) {
 			name,
 			id,
 			kind: declaration.kind,
+			replicas: declaration.kind === "websocket-api" ? declaration.replicas ?? 1 : 1,
 			path: app.path,
 			port: app.port,
 			host,
-			url: `https://${host}${options.local && options.https !== 443 ? `:${options.https}` : ""}`,
+			url: `${declaration.kind === "websocket-api" ? "wss" : "https"}://${host}${options.local && options.https !== 443 ? `:${options.https}` : ""}`,
 			ref,
 			tag,
 			...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${name}` } } : {}
@@ -2094,6 +2113,10 @@ function hostOf(name, app, workspace, resource, options) {
 	if (options.local) return hostFor(resource, workspace.name);
 	return resolveHost(name, app, options.stage, workspace.domains, isMainFrontendApp(name, app, workspace.apps));
 }
+/** An app's compose services, one per replica: `api`, `api-2`, `api-3`. */
+function replicaNames(app) {
+	return [app.name, ...Array.from({ length: app.replicas - 1 }, (_, i) => `${app.name}-${i + 2}`)];
+}
 /** The compose document: the infrastructure, the apps, and the edge. */
 function stackFile(options) {
 	const { project, plan, apps } = options;
@@ -2137,27 +2160,31 @@ function stackFile(options) {
 	if (services["redis"] && options.redis) services[REDIS_SERVICE] = redisService(options.redis);
 	if (options.logs) services[LOGS_SERVICE] = logsService(options.logs);
 	if (options.backups) services[BACKUPS_SERVICE] = backupsService(options.backups, options.envFiles);
-	for (const app of apps) services[app.name] = {
-		image: app.ref,
-		...app.build ? { build: {
-			...composeBuildPaths({
-				composeDir: options.composeDir,
-				buildRoot: options.buildRoot,
-				workspaceRoot: options.workspaceRoot,
-				dockerfile: app.build.dockerfile
-			}),
-			...app.build.args ? { args: app.build.args } : {}
-		} } : {},
-		restart: "unless-stopped",
-		...app.kind === "rest-api" ? {
-			env_file: [{
-				path: `./${app.name}.env`,
-				format: "raw"
-			}],
-			...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {}
-		} : {},
-		healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health")
-	};
+	for (const app of apps) {
+		const definition = {
+			image: app.ref,
+			...app.build ? { build: {
+				...composeBuildPaths({
+					composeDir: options.composeDir,
+					buildRoot: options.buildRoot,
+					workspaceRoot: options.workspaceRoot,
+					dockerfile: app.build.dockerfile
+				}),
+				...app.build.args ? { args: app.build.args } : {}
+			} } : {},
+			restart: "unless-stopped",
+			...app.kind !== "site" ? {
+				env_file: [{
+					path: `./${app.name}.env`,
+					format: "raw"
+				}],
+				...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {}
+			} : {},
+			healthcheck: probe(app.port, app.kind === "site" ? "/" : "/health"),
+			...app.kind === "websocket-api" ? { ulimits: { nofile: NOFILE } } : {}
+		};
+		for (const name of replicaNames(app)) services[name] = { ...definition };
+	}
 	for (const worker of [...options.workers, ...options.processors]) services[worker.name] = {
 		image: worker.ref,
 		...worker.build ? { build: composeBuildPaths({
@@ -2179,8 +2206,9 @@ function stackFile(options) {
 		restart: "unless-stopped",
 		ports: [`${options.https}:443`, `${options.http}:80`],
 		volumes: ["caddy-data:/data", "caddy-config:/config"],
+		...EDGE_LIMITS,
 		depends_on: Object.fromEntries([
-			...apps.map((app) => app.name),
+			...apps.flatMap(replicaNames),
 			...options.workers.filter((w) => w.push).map((w) => w.name),
 			...options.processors.map((p) => p.name)
 		].map((name) => [name, HEALTHY])),
@@ -2906,7 +2934,7 @@ function assertRedisClient(workspace, stack, manifest, runnables) {
 	if (!stack.plan.resources.some((r) => r.kind === "cache")) return;
 	const cacheKeys = Object.values(manifest).filter((d) => d.kind === "cache").flatMap((d) => d.provides ?? []);
 	const reachesCache = (keys) => cacheKeys.some((key) => keys?.has(key));
-	const missing = [.../* @__PURE__ */ new Set([...stack.apps.filter((app) => app.kind === "rest-api" && reachesCache(appEnvKeys(manifest, app.name, runnables))).map((a) => a.name), ...stack.workers.filter((worker) => reachesCache(workerEnvKeys(manifest, worker.id, runnables))).map((worker) => worker.host)])].filter((name) => {
+	const missing = [.../* @__PURE__ */ new Set([...stack.apps.filter((app) => (app.kind === "rest-api" || app.kind === "websocket-api") && reachesCache(appEnvKeys(manifest, app.name, runnables))).map((a) => a.name), ...stack.workers.filter((worker) => reachesCache(workerEnvKeys(manifest, worker.id, runnables))).map((worker) => worker.host)])].filter((name) => {
 		const app = workspace.apps[name];
 		return app && !installedFrom(join(workspace.root, app.path), "ioredis");
 	}).sort();
@@ -3551,7 +3579,7 @@ function currentUser() {
 	}
 }
 async function checkApp(ctx, app, deps, options) {
-	const url = `${app.url}${app.kind === "site" ? "/" : "/health"}`;
+	const url = `${app.url.replace(/^ws/, "http")}${app.kind === "site" ? "/" : "/health"}`;
 	let last = "not asked";
 	for (let attempt = 1; attempt <= deps.healthAttempts; attempt++) {
 		ctx.signal.throwIfAborted();
@@ -3804,4 +3832,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { dockerCompose as C, sshTarget as S, parseDigests as _, edgePorts as a, dockerHost as b, edgeRef as c, composeStack as d, derivedCredentials as f, edgeAlias as g, EDGE_PROJECT as h, ComposePushNeedsBuild as i, removeEdgeRoutes as l, stackPlan as m, compose_exports as n, stackOverrideFile as o, stackDir as p, ComposePinNeedsPull as r, deployedStackSecrets as s, composeTarget as t, composeProject as u, pinnedRef as v, projectNetwork as w, sshAccess as x, composeServer as y };
 
-//# sourceMappingURL=compose-CvHIjMDd.mjs.map
+//# sourceMappingURL=compose-CIzCcsoz.mjs.map