@geekmidas/cli 10.0.0-alpha.39 → 10.0.0-alpha.40

package/dist/{workspace-CrFbItPz.mjs → workspace-DwS1JK5u.mjs}

@@ -4,7 +4,7 @@ import { c as loadWorkspaceAppInfo, f as appKey, l as loadWorkspaceConfig, r as
 import { E as TEST_STAGE, t as allConstructGlobs } from "./workspace-DOmIhiau.mjs";
 import { i as toEmbeddableSecrets } from "./storage-BzaUxmqe.mjs";
 import { i as FileSecretsStore, n as secretsStoreFor } from "./store-DeGATCS-.mjs";
-import { c as readFakes } from "./ready-BXmLS4VB.mjs";
+import { c as readFakes } from "./ready-D8UXsP6q.mjs";
 import { existsSync } from "node:fs";
 import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { networkInterfaces } from "node:os";
@@ -15,7 +15,11 @@ import { createServer } from "node:net";
 import { config } from "dotenv";
 import { createHash } from "node:crypto";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
+import * as snsUrl from "@geekmidas/events/sns/url";
+import * as sqsUrl from "@geekmidas/events/sqs/url";
 import { CreateBucketCommand, GetBucketPolicyCommand, HeadBucketCommand, PutBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";
+import { CreateTopicCommand, GetTopicAttributesCommand, SNSClient } from "@aws-sdk/client-sns";
+import { CreateQueueCommand, GetQueueUrlCommand, SQSClient } from "@aws-sdk/client-sqs";
 import { Client } from "pg";
 import { stringify } from "yaml";
 import { promisify } from "node:util";
@@ -612,6 +616,39 @@ const GENERATED = `# Generated by gkm from the construct manifest — do not edi
 # from code; a browser needs the root trusted once.
 `;
 //#endregion
+//#region src/reconcile/emulator.ts
+/**
+* The AWS emulator (floci, LocalStack-compatible) the `sns` backend runs on
+* locally — the facts the compose file, the env writer and the applier must
+* agree on.
+*
+* The emulator has one account and answers with deterministic ARNs and queue
+* URLs, which is what lets a connection string be composed before the topic
+* or queue it names has been created.
+*/
+/** The emulator's single account. */
+const EMULATOR_ACCOUNT = "000000000000";
+const EMULATOR_REGION = "us-east-1";
+/**
+* The emulator's credential. The `LSIA` prefix is what LocalStack required on
+* issued keys; floci does not care, and keeping it means a project that pins
+* the old image still works.
+*/
+const EMULATOR_CREDENTIALS = {
+	accessKeyId: "LSIAQAAAAAAVNCBMPNSG",
+	secretAccessKey: "geekmidas"
+};
+/** The emulator's address from the host, on the port it was published on. */
+function emulatorEndpoint(port) {
+	return `http://localhost:${port}`;
+}
+function emulatorTopicArn(name) {
+	return `arn:aws:sns:${EMULATOR_REGION}:${EMULATOR_ACCOUNT}:${name}`;
+}
+function emulatorQueueUrl(name, port) {
+	return `${emulatorEndpoint(port)}/${EMULATOR_ACCOUNT}/${name}`;
+}
+//#endregion
 //#region src/workspace/rootSite.ts
 /**
 * Which site the base domain points at — deployed and locally alike.
@@ -1153,10 +1190,8 @@ function brokerEnv(plan, ports) {
 	const carrier = plan.resources.find((r) => r.kind === "queue" || r.kind === "topic");
 	const publisher = carrier ? urlFor(carrier, plan, ports, "") : plan.workerBroker ? workerBroker(plan, ports) : void 0;
 	if (!publisher) return {};
-	return {
-		EVENT_PUBLISHER_CONNECTION_STRING: publisher,
-		EVENT_SUBSCRIBER_CONNECTION_STRING: plan.events === "sns" ? publisher.replace(/^sns:/, "sqs:") : publisher
-	};
+	if (plan.events === "sns") return {};
+	return { EVENT_PUBLISHER_CONNECTION_STRING: publisher };
 }
 /**
 * The broker a worker schedules its crons through, when nothing else declared
@@ -1226,7 +1261,7 @@ function urlFor(resource, plan, ports, project, addresses = {}) {
 				default: return `http://:${LOCAL_TOKEN$1}@${LOCAL_HOST}:${port}`;
 			}
 		case "queue":
-		case "topic": return broker(plan, port);
+		case "topic": return broker(plan, port, resource);
 		default: return;
 	}
 }
@@ -1237,7 +1272,7 @@ function urlFor(resource, plan, ports, project, addresses = {}) {
 * same `.publish()` reaches pg-boss here and SQS deployed because the string it
 * was handed said so.
 */
-function broker(plan, port) {
+function broker(plan, port, resource) {
 	switch (plan.events) {
 		case "pgboss": {
 			const database = plan.resources.find((r) => r.kind === "database");
@@ -1245,7 +1280,23 @@ function broker(plan, port) {
 			return `pgboss://${LOCAL_USER$2}:${LOCAL_USER$2}@${LOCAL_HOST}:${port}/${database.name}?schema=${PGBOSS_SCHEMA}`;
 		}
 		case "rabbitmq": return `rabbitmq://${LOCAL_USER$2}:${LOCAL_USER$2}@${LOCAL_HOST}:${port}?exchange=${RABBITMQ_EXCHANGE}`;
-		case "sns": throw new UnprovisionedEventsBackend("sns");
+		case "sns": {
+			if (!resource) throw new UnprovisionedEventsBackend("sns");
+			const endpoint = emulatorEndpoint(port);
+			const address = resource.kind === "topic" ? snsUrl.build({
+				topicArn: emulatorTopicArn(resource.name),
+				region: EMULATOR_REGION,
+				endpoint
+			}) : sqsUrl.build({
+				queueUrl: emulatorQueueUrl(resource.name, port),
+				region: EMULATOR_REGION,
+				endpoint
+			});
+			const url = new URL(address);
+			url.searchParams.set("accessKeyId", EMULATOR_CREDENTIALS.accessKeyId);
+			url.searchParams.set("secretAccessKey", EMULATOR_CREDENTIALS.secretAccessKey);
+			return url.toString();
+		}
 	}
 }
 /** A local Postgres URL, master credential and all. */
@@ -1320,16 +1371,15 @@ function schemaOf(resource, plan) {
 	}
 }
 /**
-* A backend whose local addresses cannot be derived yet.
+* A broker address asked for without the topic or queue it would name.
 *
-* SNS and SQS are addressed by ARN, which means the topic and queue have to be
-* created in LocalStack before a URL can name them. Until that provisioning
-* lands, saying so is better than handing out a string that fails on first use.
+* On SNS each topic and queue is its own address, so there is no project-wide
+* one to hand out — a cron's schedule store, say, cannot live there.
 */
 var UnprovisionedEventsBackend = class extends Error {
 	backend;
 	constructor(backend) {
-		super(`The local target cannot derive addresses for '${backend}' yet — its topics and queues are named by ARN, which nothing creates locally. Use 'pgboss' (the default) or 'rabbitmq' for local development.`);
+		super(`'${backend}' has no single broker address: each topic and queue is addressed by its own ARN. Something asked for one without naming the topic or queue.`);
 		this.backend = backend;
 		this.name = "UnprovisionedEventsBackend";
 	}
@@ -1438,20 +1488,23 @@ function appEnvKeys(manifest, appName, runnables = {}) {
 		...declaration.kind === "rest-api" ? declaration.endpoints.flatMap((endpoint) => endpoint.requires ?? []) : []
 	]);
 	const edges = [...dependenciesOf(declaration).map((edge) => edge.target), ...runnables[id] ?? []];
-	if (declaration.kind === "rest-api" && declaration.endpoints.length === 0) for (const [otherId, other] of Object.entries(manifest)) {
-		if (other.kind !== "worker") continue;
-		edges.push(...dependenciesOf(other).map((edge) => edge.target), ...runnables[otherId] ?? []);
-		keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
-		keys.add("EVENT_SUBSCRIBER_CONNECTION_STRING");
+	if (declaration.kind === "rest-api" && declaration.endpoints.length === 0) {
+		const runsWorkers = Object.values(manifest).some((other) => other.kind === "worker");
+		for (const [otherId, other] of Object.entries(manifest)) {
+			if (other.kind !== "worker") continue;
+			edges.push(...dependenciesOf(other).map((edge) => edge.target), ...runnables[otherId] ?? []);
+			keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
+		}
+		if (runsWorkers) for (const other of Object.values(manifest)) {
+			if (other.kind !== "queue" && other.kind !== "topic") continue;
+			for (const key of other.provides ?? []) keys.add(key);
+		}
 	}
 	for (const id of edges) {
 		const target = manifest[id];
 		if (!target) continue;
 		for (const key of target.provides ?? []) keys.add(key);
-		if (target.kind === "queue" || target.kind === "topic") {
-			keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
-			keys.add("EVENT_SUBSCRIBER_CONNECTION_STRING");
-		}
+		if (target.kind === "queue" || target.kind === "topic") keys.add("EVENT_PUBLISHER_CONNECTION_STRING");
 		if (target.kind === "objects") {
 			keys.add("AWS_ACCESS_KEY_ID");
 			keys.add("AWS_SECRET_ACCESS_KEY");
@@ -1577,6 +1630,40 @@ function bucketClient(port) {
 		}
 	};
 }
+/** A topic and queue client pointed at the local AWS emulator. */
+function carrierClient(port) {
+	const config = {
+		region: EMULATOR_REGION,
+		endpoint: emulatorEndpoint(port),
+		credentials: EMULATOR_CREDENTIALS
+	};
+	const sns = new SNSClient(config);
+	const sqs = new SQSClient(config);
+	return {
+		async topicExists(name) {
+			try {
+				await sns.send(new GetTopicAttributesCommand({ TopicArn: emulatorTopicArn(name) }));
+				return true;
+			} catch {
+				return false;
+			}
+		},
+		async createTopic(name) {
+			await sns.send(new CreateTopicCommand({ Name: name }));
+		},
+		async queueExists(name) {
+			try {
+				await sqs.send(new GetQueueUrlCommand({ QueueName: name }));
+				return true;
+			} catch {
+				return false;
+			}
+		},
+		async createQueue(name) {
+			await sqs.send(new CreateQueueCommand({ QueueName: name }));
+		}
+	};
+}
 //#endregion
 //#region src/reconcile/compose.ts
 /**
@@ -1815,18 +1902,19 @@ function define(container, image, published) {
 			image,
 			restart: "unless-stopped",
 			ports: published,
+			extra_hosts: ["host.docker.internal:host-gateway"],
 			environment: {
-				AWS_DEFAULT_REGION: "us-east-1",
-				AWS_ACCESS_KEY_ID: "LSIAQAAAAAAVNCBMPNSG",
-				AWS_SECRET_ACCESS_KEY: LOCAL_USER
+				AWS_DEFAULT_REGION: EMULATOR_REGION,
+				AWS_ACCESS_KEY_ID: EMULATOR_CREDENTIALS.accessKeyId,
+				AWS_SECRET_ACCESS_KEY: EMULATOR_CREDENTIALS.secretAccessKey
 			},
 			volumes: ["localstack-data:/var/lib/localstack"],
 			healthcheck: {
 				test: [
 					"CMD",
-					"curl",
-					"-f",
-					"http://localhost:4566/_localstack/health"
+					"bash",
+					"-c",
+					"exec 3<>/dev/tcp/localhost/4566"
 				],
 				interval: "10s",
 				timeout: "5s",
@@ -2341,6 +2429,47 @@ function bucketPolicy(bucket, open) {
 	});
 }
 /**
+* The topics and queues to create on the AWS emulator.
+*
+* Only on the `sns` backend: pg-boss makes its own tables on first connect and
+* a RabbitMQ exchange is declared by the client, but an SNS topic and an SQS
+* queue must exist before anything can publish to them.
+*/
+function carrierNames(plan) {
+	if (plan.events !== "sns") return {
+		topics: [],
+		queues: []
+	};
+	const named = (kind) => plan.resources.filter((r) => r.kind === kind).map((r) => r.name);
+	return {
+		topics: named("topic"),
+		queues: named("queue")
+	};
+}
+/** Create each topic and queue the plan names, skipping those that exist. */
+async function applyCarriers(client, carriers) {
+	const applied = [];
+	for (const name of carriers.topics) {
+		const created = !await client.topicExists(name);
+		if (created) await client.createTopic(name);
+		applied.push({
+			id: name,
+			describe: `topic ${name}`,
+			created
+		});
+	}
+	for (const name of carriers.queues) {
+		const created = !await client.queueExists(name);
+		if (created) await client.createQueue(name);
+		applied.push({
+			id: name,
+			describe: `queue ${name}`,
+			created
+		});
+	}
+	return applied;
+}
+/**
 * Apply each served bucket's open-path policy, skipping those already correct.
 *
 * Compared as parsed JSON rather than as text: the same policy re-serialised
@@ -2525,7 +2654,7 @@ const CADDY_ROOT_IN_CONTAINER = "/data/caddy/pki/authorities/local/root.crt";
 * hash and one health check.
 */
 async function reconcile(options) {
-	const { root, project, manifest, stage, start = true, provision = true, docker = dockerCli, probe = isPortFree, sql = pgClient, buckets = bucketClient } = options;
+	const { root, project, manifest, stage, start = true, provision = true, docker = dockerCli, probe = isPortFree, sql = pgClient, buckets = bucketClient, carriers = carrierClient } = options;
 	const plan = planFor(manifest, stage, provisionOrder(manifest), {
 		localStage: options.localStage,
 		events: options.events,
@@ -2587,7 +2716,7 @@ async function reconcile(options) {
 	if (start && plan.containers.length > 0) await docker.up(composePath, plan.containers);
 	if (start && plan.containers.includes("caddy")) await docker.reload(composePath, "caddy").catch(() => {});
 	if (start && plan.containers.includes("caddy")) await docker.copyOut(composePath, "caddy", CADDY_ROOT_IN_CONTAINER, join(root, LOCAL_CA_PATH)).catch(() => {});
-	const provisioned = start && provision ? await create(plan, ports, sql, buckets, project) : [];
+	const provisioned = start && provision ? await create(plan, ports, sql, buckets, carriers, project) : [];
 	await saveState(root, {
 		hash,
 		stage
@@ -2599,12 +2728,12 @@ async function reconcile(options) {
 	};
 }
 /**
-* Create the databases, schemas, and buckets the plan names.
+* Create the databases, schemas, buckets, topics and queues the plan names.
 *
 * Idempotent throughout, so this runs on every non-converged reconcile rather
 * than being something to remember.
 */
-async function create(plan, ports, sql, buckets, project) {
+async function create(plan, ports, sql, buckets, emulatorCarriers, project) {
 	const applied = [];
 	const postgresPort = ports[primaryPortKey("postgres")];
 	const statements = postgresStatements(plan, project);
@@ -2617,6 +2746,9 @@ async function create(plan, ports, sql, buckets, project) {
 		if (names.length > 0) applied.push(...await applyBuckets(client, names));
 		if (policies.length > 0) applied.push(...await applyPolicies(client, policies));
 	}
+	const emulatorPort = ports[primaryPortKey("localstack")];
+	const carriers = carrierNames(plan);
+	if (emulatorPort !== void 0 && carriers.topics.length + carriers.queues.length > 0) applied.push(...await applyCarriers(emulatorCarriers(emulatorPort), carriers));
 	return applied;
 }
 /**
@@ -2821,4 +2953,4 @@ function localAddress(port) {
 //#endregion
 export { findAvailablePort as C, prepareEntryCredentials as D, loadSecretsForApp as E, createEntryWrapper as S, loadEnvFiles as T, cacheBackendFor as _, reconcileWorkspace as a, storageBackendFor as b, LOCAL_CA_PATH as c, quoteIdentifier as d, pgClient as f, primaryPortKey as g, fakeKey as h, derivedContainers as i, forgetState as l, rootSite as m, backendsOf as n, workspace_exports as o, resourceName as p, constructGlobs as r, COMPOSE_PATH as s, FAKE_ENV as t, applyPostgres as u, eventsBackendFor as v, isPortAvailable as w, createCredentialsPreload as x, providerOf as y };
 
-//# sourceMappingURL=workspace-CrFbItPz.mjs.map
+//# sourceMappingURL=workspace-DwS1JK5u.mjs.map