@geekmidas/cli 10.0.0-alpha.26 → 10.0.0-alpha.27

package/dist/index.mjs

@@ -1,15 +1,14 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as DEFAULT_CACHE, r as ConstructGenerator, s as isPartitionedRoutes, t as discover } from "./discover-0fhCbnk0.mjs";
-import { i as loadConfig, l as derivedApps, n as getAppNameFromCwd, o as loadWorkspaceConfig, r as loadAppConfig, s as parseModuleConfig } from "./config-DBGpRTUy.mjs";
-import { A as stripPublicPrefix, C as InvalidStages, D as stageProblems, E as deployedProblems, T as assertDeployedStage, a as getAppBuildOrder, k as getPublicEnvPrefix, o as getAppGkmConfig, s as getDependencyEnvVars, t as allConstructGlobs, v as getDeployTargetError, w as TEST_STAGE, y as isDeployTargetSupported } from "./workspace-Bu3xNCej.mjs";
-import { C as providerOf, S as eventsBackendFor, _ as COMPOSE_PATH, a as loadEnvFiles, b as resourceName, c as resolveServicePorts, d as backendsOf, f as constructGlobs, h as usesConstructs, i as isPortAvailable, l as rewriteUrlsWithPorts, m as reconcileWorkspace, n as createEntryWrapper, o as loadSecretsForApp, p as derivedContainers, r as findAvailablePort, s as prepareEntryCredentials, t as createCredentialsPreload, u as startWorkspaceServices, v as LOCAL_CA_PATH, w as storageBackendFor, x as cacheBackendFor, y as applyPostgres } from "./credentials-DI9kJcaP.mjs";
-import { a as generateServiceCredentials, i as generateSecurePassword, n as generateConnectionUrls, o as rotateServicePassword, t as createStageSecrets } from "./generator-LfZU7NlU.mjs";
+import { a as loadConfig, c as parseModuleConfig, i as loadAppConfig, r as getAppNameFromCwd, s as loadWorkspaceConfig, u as derivedApps } from "./config-DXrrYvob.mjs";
+import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-T4IVGSoB.mjs";
 import { c as getKeyPath, i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-TP0x118M.mjs";
-import { a as openapiCommand, c as EndpointGenerator, l as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, s as OpenApiTsGenerator, t as OPENAPI_OUTPUT_PATH$1 } from "./openapi-DHQlstv6.mjs";
+import { _ as isPortAvailable, b as prepareEntryCredentials, c as applyPostgres, d as eventsBackendFor, f as providerOf, g as findAvailablePort, h as createEntryWrapper, i as reconcileWorkspace, l as resourceName, m as createCredentialsPreload, n as constructGlobs, o as COMPOSE_PATH, p as storageBackendFor, r as derivedContainers, s as LOCAL_CA_PATH, t as backendsOf, u as cacheBackendFor, v as loadEnvFiles, y as loadSecretsForApp } from "./workspace-CUmR_k4J.mjs";
+import { a as openapiCommand, c as EndpointGenerator, l as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, s as OpenApiTsGenerator, t as OPENAPI_OUTPUT_PATH$1 } from "./openapi-3NLVvtz-.mjs";
 import { i as withRoutes, r as withCompute } from "./emit-Bzq7JsMP.mjs";
-import { i as writeDockerEnvFromSecrets, r as generateFullstackCustomSecrets } from "./reconcile-gb1lz1Dk.mjs";
-import { a as isRemoteStore, n as pullStageSecrets, r as pushStageSecrets, t as NoStoredSecrets } from "./transfer-CAJs_vhu.mjs";
+import { a as createStageSecrets, c as generateServiceCredentials, i as writeDockerEnvFromSecrets, l as rotateServicePassword, o as generateConnectionUrls, r as generateFullstackCustomSecrets, s as generateSecurePassword } from "./reconcile-DhbCvh4K.mjs";
+import { a as isRemoteStore, n as pullStageSecrets, r as pushStageSecrets, t as NoStoredSecrets } from "./transfer-BV00TxZv.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { stdin, stdout } from "node:process";
@@ -22,13 +21,13 @@ import { execFile, execSync, spawn } from "node:child_process";
 import { cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, kebabCase, provideKey, provisionOrder, scopedName, serviceKey } from "@geekmidas/manifest";
 import fg from "fast-glob";
 import chokidar from "chokidar";
-import { parse as parse$1, parseDocument } from "yaml";
 import { createCipheriv, createHash, randomBytes } from "node:crypto";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { Client } from "pg";
+import { parse as parse$1, parseDocument } from "yaml";
 import { promisify } from "node:util";
 import { cacheTableStatements } from "@geekmidas/cache/postgres";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Function } from "@geekmidas/constructs/functions";
 import { Queue } from "@geekmidas/constructs/queue";
@@ -39,7 +38,7 @@ import prompts from "prompts";
 import { EnvironmentParser } from "@geekmidas/envkit";
 import { serviceContext } from "@geekmidas/services";
 //#region package.json
-var version = "10.0.0-alpha.26";
+var version = "10.0.0-alpha.27";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -431,10 +430,7 @@ async function execCommand(commandArgs, options = {}) {
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	const defaultEnv = loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$12.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({
-		cwd,
-		resolveDockerPorts: "readonly"
-	});
+	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({ cwd });
 	if (appName) logger$12.log(`📦 App: ${appName}`);
 	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
 	if (secretCount > 0) logger$12.log(`🔐 Loaded ${secretCount} secret(s)`);
@@ -592,6 +588,7 @@ async function devCommand(options) {
 			return workspaceDevCommand(loadedConfig.workspace, options);
 		}
 		config = loadedConfig.raw;
+		workspace = loadedConfig.workspace;
 	}
 	else {
 		const loadedConfig = await loadWorkspaceConfig();
@@ -636,24 +633,13 @@ async function devCommand(options) {
 	const runtime = config.runtime ?? "node";
 	let secretsJsonPath;
 	const appSecrets = await loadSecretsForApp(secretsRoot, config.stages.local, workspaceAppName);
-	if (workspace && usesConstructs(workspace)) {
+	if (workspace) {
 		const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
 		if (reconciled.changed && reconciled.plan.containers.length > 0) {
 			logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
 			for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
 		}
 		Object.assign(appSecrets, reconciled.env);
-	} else {
-		const resolvedPorts = await resolveServicePorts(secretsRoot);
-		if (Object.keys(resolvedPorts.ports).length > 0) {
-			const rewritten = rewriteUrlsWithPorts(appSecrets, resolvedPorts);
-			Object.assign(appSecrets, rewritten);
-			logger$11.log(`🔌 Applied ${Object.keys(resolvedPorts.ports).length} port mapping(s)`);
-		}
-	}
-	if (workspace && workspaceAppName) {
-		const depEnv = getDependencyEnvVars(workspace, workspaceAppName);
-		for (const [key, value] of Object.entries(depEnv)) appSecrets[key] ??= value;
 	}
 	if (Object.keys(appSecrets).length > 0) {
 		const secretsDir = join(secretsRoot, ".gkm");
@@ -722,19 +708,6 @@ async function devCommand(options) {
 	process.on("SIGTERM", shutdown);
 }
 /**
-* Generate all dependency environment variables for all apps.
-* Returns a flat object with all {APP_NAME}_URL variables.
-* @internal Exported for testing
-*/
-function generateAllDependencyEnvVars(workspace, urlPrefix = "http://localhost") {
-	const env = {};
-	for (const appName of Object.keys(workspace.apps)) {
-		const appEnv = getDependencyEnvVars(workspace, appName, urlPrefix);
-		Object.assign(env, appEnv);
-	}
-	return env;
-}
-/**
 * Check for port conflicts across all apps.
 * Returns list of conflicts if any ports are duplicated.
 * @internal Exported for testing
@@ -959,38 +932,26 @@ async function workspaceDevCommand(workspace, options) {
 		logger$11.log("✅ Frontend apps validated");
 	}
 	const rawSecrets = await loadDevSecrets(workspace);
-	let secretsEnv;
+	const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
+	if (reconciled.changed && reconciled.plan.containers.length > 0) {
+		logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
+		for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
+	}
+	const secretsEnv = {
+		...rawSecrets,
+		...reconciled.env
+	};
 	const appUrls = {};
-	if (usesConstructs(workspace)) {
-		const reconciled = await reconcileWorkspace(workspace, { stage: workspace.stages.local });
-		if (reconciled.changed && reconciled.plan.containers.length > 0) {
-			logger$11.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-			for (const [container, address] of Object.entries(reconciled.addresses)) logger$11.log(`   ${container}: ${address}`);
-		}
-		secretsEnv = {
-			...rawSecrets,
-			...reconciled.env
-		};
-		for (const resource of reconciled.plan.resources) {
-			if (resource.kind !== "rest-api" && resource.kind !== "site") continue;
-			const address = reconciled.env[resource.envKey];
-			if (address) appUrls[resource.id] = address;
-		}
-	} else {
-		const resolvedPorts = await resolveServicePorts(workspace.root);
-		await startWorkspaceServices(workspace, resolvedPorts.dockerEnv, rawSecrets);
-		secretsEnv = rewriteUrlsWithPorts(rawSecrets, resolvedPorts);
+	for (const resource of reconciled.plan.resources) {
+		if (resource.kind !== "rest-api" && resource.kind !== "site") continue;
+		const address = reconciled.env[resource.envKey];
+		if (address) appUrls[resource.id] = address;
 	}
 	if (Object.keys(secretsEnv).length > 0) logger$11.log(`   Loaded ${Object.keys(secretsEnv).length} secret(s)`);
 	if (Object.keys(appUrls).length > 0) {
 		logger$11.log("🔒 App URLs:");
 		for (const [id, address] of Object.entries(appUrls)) logger$11.log(`   ${id}: ${address}`);
 	}
-	const dependencyEnv = Object.fromEntries(Object.entries(generateAllDependencyEnvVars(workspace)).filter(([key]) => secretsEnv[key] === void 0));
-	if (Object.keys(dependencyEnv).length > 0) {
-		logger$11.log("📡 Dependency URLs:");
-		for (const [key, value] of Object.entries(dependencyEnv)) logger$11.log(`   ${key}=${value}`);
-	}
 	let turboFilter = [];
 	if (options.app) {
 		if (!workspace.apps[options.app]) {
@@ -1033,7 +994,6 @@ async function workspaceDevCommand(workspace, options) {
 	const turboEnv = {
 		...process.env,
 		...secretsEnv,
-		...dependencyEnv,
 		NODE_ENV: "development",
 		...configPath ? { GKM_CONFIG_PATH: configPath } : {}
 	};
@@ -3567,10 +3527,6 @@ var UnprovisionableBucket = class extends Error {
 */
 /**
 * Provision everything the workspace declares, and return what it resolved.
-*
-* Nothing happens for a project that has not adopted the model: `usesConstructs`
-* is the same hard switch reconcile reads, so an existing deploy is untouched
-* until it declares something.
 */
 async function provisionDeclared(options) {
 	const { workspace } = options;
@@ -3580,7 +3536,6 @@ async function provisionDeclared(options) {
 		provisioned: {},
 		clusters: {}
 	};
-	if (!usesConstructs(workspace)) return empty;
 	const manifest = options.manifest ?? await discover({
 		patterns: constructGlobs(workspace),
 		cwd: workspace.root
@@ -8586,26 +8541,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.26",
-	"@geekmidas/auth": "~10.0.0-alpha.26",
-	"@geekmidas/cache": "~10.0.0-alpha.26",
-	"@geekmidas/client": "~10.0.0-alpha.26",
-	"@geekmidas/cloud": "~10.0.0-alpha.26",
-	"@geekmidas/constructs": "~10.0.0-alpha.26",
-	"@geekmidas/db": "~10.0.0-alpha.26",
-	"@geekmidas/emailkit": "~10.0.0-alpha.26",
-	"@geekmidas/envkit": "~10.0.0-alpha.26",
-	"@geekmidas/errors": "~10.0.0-alpha.26",
-	"@geekmidas/events": "~10.0.0-alpha.26",
-	"@geekmidas/logger": "~10.0.0-alpha.26",
-	"@geekmidas/manifest": "~10.0.0-alpha.26",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.26",
-	"@geekmidas/schema": "~10.0.0-alpha.26",
-	"@geekmidas/services": "~10.0.0-alpha.26",
-	"@geekmidas/storage": "~10.0.0-alpha.26",
-	"@geekmidas/studio": "~10.0.0-alpha.26",
-	"@geekmidas/telescope": "~10.0.0-alpha.26",
-	"@geekmidas/testkit": "~10.0.0-alpha.26",
+	"@geekmidas/audit": "~10.0.0-alpha.27",
+	"@geekmidas/auth": "~10.0.0-alpha.27",
+	"@geekmidas/cache": "~10.0.0-alpha.27",
+	"@geekmidas/client": "~10.0.0-alpha.27",
+	"@geekmidas/cloud": "~10.0.0-alpha.27",
+	"@geekmidas/constructs": "~10.0.0-alpha.27",
+	"@geekmidas/db": "~10.0.0-alpha.27",
+	"@geekmidas/emailkit": "~10.0.0-alpha.27",
+	"@geekmidas/envkit": "~10.0.0-alpha.27",
+	"@geekmidas/errors": "~10.0.0-alpha.27",
+	"@geekmidas/events": "~10.0.0-alpha.27",
+	"@geekmidas/logger": "~10.0.0-alpha.27",
+	"@geekmidas/manifest": "~10.0.0-alpha.27",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.27",
+	"@geekmidas/schema": "~10.0.0-alpha.27",
+	"@geekmidas/services": "~10.0.0-alpha.27",
+	"@geekmidas/storage": "~10.0.0-alpha.27",
+	"@geekmidas/studio": "~10.0.0-alpha.27",
+	"@geekmidas/telescope": "~10.0.0-alpha.27",
+	"@geekmidas/testkit": "~10.0.0-alpha.27",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -15551,7 +15506,6 @@ async function testCommand(options = {}) {
 		stage,
 		startDocker: !options.prepare,
 		secretsFileName: "test-secrets.json",
-		resolveDockerPorts: "full",
 		reconcileStage: "test"
 	});
 	let finalCredentials = { ...result.credentials };
@@ -15565,14 +15519,13 @@ async function testCommand(options = {}) {
 			console.log(`  🔍 Sniffed ${sniffed.requiredEnvVars.length} required env var(s)` + (result.declaredKeys.length > 0 ? `, kept ${result.declaredKeys.length} declared` : ""));
 		}
 	}
-	finalCredentials = rewriteDatabaseUrlForTests(finalCredentials);
 	console.log("");
 	await writeFile(result.secretsJsonPath, JSON.stringify(finalCredentials, null, 2));
 	const gkmDir = join(cwd, ".gkm");
 	const preloadPath = join(gkmDir, "test-credentials-preload.ts");
 	await createCredentialsPreload(preloadPath, result.secretsJsonPath);
 	const workspace = await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
-	const manifestPath = workspace && usesConstructs(workspace) ? await writeTestHarness({
+	const manifestPath = workspace ? await writeTestHarness({
 		root: workspace.root,
 		targets: [workspace.root, ...Object.values(workspace.apps).map((app) => isAbsolute(app.path) ? app.path : join(workspace.root, app.path))],
 		patterns: constructGlobs(workspace),
@@ -15616,29 +15569,6 @@ async function testCommand(options = {}) {
 		});
 	});
 }
-const TEST_DB_SUFFIX = "_test";
-/**
-* Rewrite DATABASE_URL to point to a separate test database.
-* Appends `_test` to the database name (e.g., `app` -> `app_test`).
-* @internal Exported for testing
-*/
-function rewriteDatabaseUrlForTests(env) {
-	const result = { ...env };
-	for (const key of Object.keys(result)) {
-		if (!key.includes("DATABASE_URL")) continue;
-		const value = result[key];
-		try {
-			const url = new URL(value);
-			const dbName = url.pathname.slice(1);
-			if (dbName && !dbName.endsWith(TEST_DB_SUFFIX)) {
-				url.pathname = `/${dbName}${TEST_DB_SUFFIX}`;
-				result[key] = url.toString();
-				console.log(`  🧪 ${key}: using test database "${dbName}${TEST_DB_SUFFIX}"`);
-			}
-		} catch {}
-	}
-	return result;
-}
 /** `gkm test` outside a project that declares stages, with none named. */
 var NoStageToTest = class extends Error {
 	constructor() {
@@ -16179,7 +16109,7 @@ program.command("secrets:push").description("Send a deployed stage's secrets to
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pushStageSecrets } = await import("./transfer-CAJs_vhu.mjs").then((n) => n.i);
+		const { pushStageSecrets } = await import("./transfer-BV00TxZv.mjs").then((n) => n.i);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pushStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -16194,7 +16124,7 @@ program.command("secrets:pull").description("Bring a deployed stage's secrets fr
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pullStageSecrets } = await import("./transfer-CAJs_vhu.mjs").then((n) => n.i);
+		const { pullStageSecrets } = await import("./transfer-BV00TxZv.mjs").then((n) => n.i);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pullStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -16209,7 +16139,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-gb1lz1Dk.mjs").then((n) => n.n);
+		const { reconcileMissingSecrets } = await import("./reconcile-DhbCvh4K.mjs").then((n) => n.n);
 		const { readStageSecrets, writeStageSecrets } = await import("./storage-TP0x118M.mjs").then((n) => n.a);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
@@ -16218,7 +16148,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./credentials-DI9kJcaP.mjs").then((n) => n.g);
+		const { derivedContainers } = await import("./workspace-CUmR_k4J.mjs").then((n) => n.a);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16277,7 +16207,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-D5SBlOx5.mjs");
+		const { deployGithubCommand } = await import("./github-Ba5kXEJo.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));