@geekmidas/cli 10.0.0-alpha.27 → 10.0.0-alpha.28

package/dist/{workspace-CUmR_k4J.mjs → workspace-cBobQVoA.mjs}

@@ -1,13 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { a as DEFAULT_EVENTS$1, i as DEFAULT_CACHE, o as DEFAULT_STORAGE, t as discover } from "./discover-0fhCbnk0.mjs";
-import { l as appKey, o as loadWorkspaceAppInfo, r as getAppNameFromCwd, s as loadWorkspaceConfig } from "./config-DXrrYvob.mjs";
+import { a as DEFAULT_EVENTS$1, i as DEFAULT_CACHE, o as DEFAULT_STORAGE, t as discover } from "./discover-CXGlQHm1.mjs";
+import { l as appKey, o as loadWorkspaceAppInfo, r as getAppNameFromCwd, s as loadWorkspaceConfig } from "./config-Dqxa-_Ge.mjs";
 import { E as TEST_STAGE, t as allConstructGlobs } from "./workspace-T4IVGSoB.mjs";
 import { n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist } from "./storage-TP0x118M.mjs";
 import { existsSync } from "node:fs";
 import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { execFile } from "node:child_process";
-import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependentsOf, provideKey, providedKeyFor, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
+import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dependentsOf, provideKey, providedKeyFor, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
 import { createServer } from "node:net";
 import { config } from "dotenv";
 import { createHash } from "node:crypto";
@@ -515,11 +515,16 @@ function portOf(address) {
 */
 function hostFor(resource, project) {
 	return [
-		resource.name,
+		resource.root && project ? stageOf(resource) : resource.name,
 		project,
 		LOCAL_TLD
 	].filter(Boolean).join(".");
 }
+/** The stage a resource's name carries, or nothing for the local stage's. */
+function stageOf(resource) {
+	const base = resource.id.toLowerCase();
+	return resource.name === base ? void 0 : resource.name.slice(base.length + 1);
+}
 /**
 * The static root config, which only ever imports.
 *
@@ -586,6 +591,49 @@ const GENERATED = `# Generated by gkm from the construct manifest — do not edi
 # from code; a browser needs the root trusted once.
 `;
 //#endregion
+//#region src/workspace/rootSite.ts
+/**
+* Which site the base domain points at — deployed and locally alike.
+*
+* Three rules, in order, and the last one is the point:
+*
+* 1. **One site** — it is the root. Unambiguous, so nothing has to be said.
+* 2. **Named `web`** — the convention wins, because people already rely on it.
+* 3. **Declared `root: true`** — the site says so itself.
+*
+* Anything else throws. It used to take the *first* site it iterated, and that
+* order came from the manifest, which is built in glob traversal order — so two
+* sites with neither named `web` meant renaming a file could move the root
+* domain, silently.
+*
+* One rule for both targets: deployed the root site gets the base domain, and
+* locally it gets the project's bare host behind the edge. Before this was
+* shared, the local edge put every site on a subdomain, so what a developer
+* browsed was not the shape production served.
+*
+* @returns the root site's name, or `undefined` when there are no sites
+* @throws {AmbiguousRootSite} when several sites could be the root and none says it is
+*/
+function rootSite(sites) {
+	if (sites.length === 0) return void 0;
+	if (sites.length === 1) return sites[0].name;
+	if (sites.some(({ name }) => name === "web")) return "web";
+	const declared = sites.filter(({ root }) => root === true);
+	if (declared.length === 1) return declared[0].name;
+	throw new AmbiguousRootSite(sites.map(({ name }) => name), declared.length > 1);
+}
+/** Several sites could hold the base domain, and none of them says it does. */
+var AmbiguousRootSite = class extends Error {
+	sites;
+	tooMany;
+	constructor(sites, tooMany = false) {
+		super(tooMany ? `More than one site declares \`root: true\` — ${sites.join(", ")}. The base domain points at one of them.` : `${sites.length} sites and nothing says which holds the base domain: ${sites.join(", ")}. Name one of them \`web\`, or declare \`root: true\` on the one the base domain points at. It used to be whichever the glob reached first, which is not a thing to decide a hostname.`);
+		this.sites = sites;
+		this.tooMany = tooMany;
+		this.name = "AmbiguousRootSite";
+	}
+};
+//#endregion
 //#region src/reconcile/plan.ts
 /**
 * The reconcile plan — what a manifest wants to exist, for one stage.
@@ -793,6 +841,15 @@ function planFor(manifest, stage, order, options = {}) {
 			for (const resource of placeless) resource.of = only.id;
 		}
 	}
+	const sites = resources.filter((r) => r.kind === "site");
+	const root = rootSite(sites.map((r) => {
+		const declared = manifest[r.id];
+		return {
+			name: appKey(r.id),
+			...declared?.kind === "site" && declared.root ? { root: true } : {}
+		};
+	}));
+	for (const site of sites) if (appKey(site.id) === root) site.root = true;
 	const workerBroker = events === "pgboss" && Object.values(manifest).some((d) => d?.kind === "worker") && resources.some((r) => r.kind === "database");
 	return {
 		stage,
@@ -1276,14 +1333,67 @@ function inNetworkEnv(workspace, manifest) {
 	});
 	return Object.fromEntries(Object.entries(env).map(([key, value]) => [key, rewrite(value)]));
 }
+/**
+* The keys one app's environment may hold: what its own declaration provides
+* and requires, and what each construct it has an edge to provides.
+*
+* The edges, not the manifest. Every app used to be handed every key the
+* workspace resolved — a web app got the database's owner URL and the auth
+* server's signing secret, and the API got the auth server's database — which
+* is exactly what a declared edge exists to rule out. A deploy composes an
+* app's environment from its edges; so does this.
+*
+* One hop: a surface an app calls is reached over HTTP, so its URL is the
+* app's business and its database is not. A site also gets the public
+* variant of each key its bundle inlines (`NEXT_PUBLIC_API_URL`), and a surface
+* the edges of the workers whose crons and subscribers its server runs.
+*
+* `undefined` for an app no declaration describes, which gets nothing but its
+* port.
+*/
+function appEnvKeys(manifest, appName, runnables = {}) {
+	const entry = Object.entries(manifest).find(([id, d]) => (d.kind === "rest-api" || d.kind === "site") && appKey(id) === appName);
+	if (!entry) return void 0;
+	const [id, declaration] = entry;
+	const keys = /* @__PURE__ */ new Set([
+		...declaration.provides ?? [],
+		...declaration.requires ?? [],
+		...declaration.kind === "rest-api" ? declaration.endpoints.flatMap((endpoint) => endpoint.requires ?? []) : []
+	]);
+	const edges = [...dependenciesOf(declaration).map((edge) => edge.target), ...runnables[id] ?? []];
+	if (declaration.kind === "rest-api" && declaration.endpoints.length === 0) for (const [otherId, other] of Object.entries(manifest)) {
+		if (other.kind !== "worker") continue;
+		edges.push(...dependenciesOf(other).map((edge) => edge.target), ...runnables[otherId] ?? []);
+		keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
+		keys.add("EVENT_SUBSCRIBER_CONNECTION_STRING");
+	}
+	for (const id of edges) {
+		const target = manifest[id];
+		if (!target) continue;
+		for (const key of target.provides ?? []) keys.add(key);
+		if (target.kind === "queue" || target.kind === "topic") {
+			keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
+			keys.add("EVENT_SUBSCRIBER_CONNECTION_STRING");
+		}
+		if (target.kind === "objects") {
+			keys.add("AWS_ACCESS_KEY_ID");
+			keys.add("AWS_SECRET_ACCESS_KEY");
+			keys.add("AWS_REGION");
+		}
+	}
+	if (declaration.kind === "site") for (const key of Object.keys(publicEnvFor(declaration, manifest))) keys.add(key);
+	return keys;
+}
 /** One compose service per app the workspace runs, behind the apps profile. */
-function appServices(workspace, manifest, containers) {
+function appServices(workspace, manifest, containers, runnables = {}) {
 	const env = inNetworkEnv(workspace, manifest);
 	const services = {};
 	for (const [name, app] of Object.entries(workspace.apps)) {
 		if (app.type === "mobile" || !app.port) continue;
 		const key = appKey(name);
 		const health = app.type === "web" ? "/" : "/health";
+		const allowed = appEnvKeys(manifest, name, runnables);
+		const own = Object.fromEntries(Object.entries(env).filter(([envKey]) => allowed?.has(envKey)));
 		services[key] = {
 			image: `${key}:\${TAG:-latest}`,
 			build: {
@@ -1295,7 +1405,7 @@ function appServices(workspace, manifest, containers) {
 			environment: {
 				NODE_ENV: "production",
 				PORT: String(app.port),
-				...env
+				...own
 			},
 			...containers.some((c) => c !== "caddy") ? { depends_on: containers.filter((c) => c !== "caddy") } : {},
 			healthcheck: {
@@ -2500,10 +2610,13 @@ async function derivedContainers(workspace, stage, manifest) {
 * stays a pure-ish function of its inputs and the store keeps its single owner.
 */
 async function reconcileWorkspace(workspace, options) {
-	const manifest = options.manifest ?? await discover({
+	const runnables = {};
+	const discovered = await discover({
 		patterns: constructGlobs(workspace),
-		cwd: workspace.root
+		cwd: workspace.root,
+		runnables
 	});
+	const manifest = options.manifest ?? discovered;
 	const result = await reconcile({
 		root: workspace.root,
 		project: workspace.name,
@@ -2513,7 +2626,7 @@ async function reconcileWorkspace(workspace, options) {
 		...backendsOf(workspace),
 		saved: await loadPortState(workspace.root),
 		addresses: surfaceAddresses(workspace, manifest),
-		apps: (containers) => appServices(workspace, manifest, containers),
+		apps: (containers) => appServices(workspace, manifest, containers, runnables),
 		...options.start === void 0 ? {} : { start: options.start }
 	});
 	await savePortState(workspace.root, { ...result.ports });
@@ -2550,6 +2663,6 @@ function localAddress(port) {
 	return `http://localhost:${port}`;
 }
 //#endregion
-export { isPortAvailable as _, workspace_exports as a, prepareEntryCredentials as b, applyPostgres as c, eventsBackendFor as d, providerOf as f, findAvailablePort as g, createEntryWrapper as h, reconcileWorkspace as i, resourceName as l, createCredentialsPreload as m, constructGlobs as n, COMPOSE_PATH as o, storageBackendFor as p, derivedContainers as r, LOCAL_CA_PATH as s, backendsOf as t, cacheBackendFor as u, loadEnvFiles as v, loadSecretsForApp as y };
+export { findAvailablePort as _, workspace_exports as a, loadSecretsForApp as b, applyPostgres as c, cacheBackendFor as d, eventsBackendFor as f, createEntryWrapper as g, createCredentialsPreload as h, reconcileWorkspace as i, resourceName as l, storageBackendFor as m, constructGlobs as n, COMPOSE_PATH as o, providerOf as p, derivedContainers as r, LOCAL_CA_PATH as s, backendsOf as t, rootSite as u, isPortAvailable as v, prepareEntryCredentials as x, loadEnvFiles as y };
 
-//# sourceMappingURL=workspace-CUmR_k4J.mjs.map
+//# sourceMappingURL=workspace-cBobQVoA.mjs.map