@geekmidas/cli 10.0.0-alpha.45 → 10.0.0-alpha.47

package/dist/{workspace-dV6f-3vv.cjs → workspace-vafrzZTC.cjs}

@@ -1,10 +1,11 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_discover = require("./discover-B0f_kuNN.cjs");
-const require_config = require("./config-CJ-PAb7M.cjs");
-const require_workspace = require("./workspace-RYSYtHP7.cjs");
+const require_discover = require("./discover-DXNviAh-.cjs");
+const require_config = require("./config-CsYSyUya.cjs");
+const require_workspace = require("./workspace-DEibcoBe.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
 const require_store = require("./store-DQgxT_WR.cjs");
-const require_ready = require("./ready-3RfHxdA0.cjs");
+const require_ready = require("./ready-lr2Fm-ep.cjs");
+const require_backends = require("./backends-B9V2XD2M.cjs");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
@@ -14,6 +15,7 @@ let _geekmidas_manifest = require("@geekmidas/manifest");
 let node_net = require("node:net");
 let dotenv = require("dotenv");
 let node_crypto = require("node:crypto");
+let _geekmidas_constructs_encryption = require("@geekmidas/constructs/encryption");
 let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let _geekmidas_events_sns_url = require("@geekmidas/events/sns/url");
 _geekmidas_events_sns_url = require_rolldown_runtime.__toESM(_geekmidas_events_sns_url, 1);
@@ -248,62 +250,6 @@ async function prepareEntryCredentials(options) {
 	};
 }
 //#endregion
-//#region src/workspace/backends.ts
-/**
-* Which backend each declared kind resolves to — decided by where the project
-* deploys, and by nothing else.
-*
-* These used to be read out of a `services:` block, where one key answered two
-* questions: *does this exist* and *what backs it*. The first is the manifest's
-* — a declared `Cache` is why there is a cache — and the second is the deploy
-* target's, because the right cache for a Lambda is not the right cache for a
-* box already running Postgres. With both answered elsewhere there was nothing
-* left for the block to say, so it is gone and these read the target.
-*
-* Mail has no answer here at all: every provider speaks SMTP, so the provider
-* is whichever one the stage's mail URL points at.
-*/
-/**
-* Which family of defaults a workspace's deploy target belongs to.
-*
-* One question, asked once: **does this target run containers the project
-* controls?** Dokploy and a bare server do, so a bucket or a cache can live
-* beside the app; AWS, Vercel and Cloudflare do not, so the default has to be
-* something managed. That is the whole of the distinction, and it is why
-* `MainProvider` is the right axis rather than the deploy target's own name —
-* three targets share one answer.
-*
-* An AWS deploy names no `deploy.default` at all, because it goes through SST,
-* which is why the absence is what selects `aws`.
-*/
-function providerOf(workspace) {
-	const target = workspace.deploy?.default;
-	return target === "dokploy" || target === "server" ? "server" : "aws";
-}
-/**
-* The cache backend a target implies.
-*
-* The same answer locally and deployed: a local `gkm dev` for an AWS app still
-* uses the Upstash protocol, because a backend that differed between the two
-* would be worse than a slower one.
-*/
-function cacheBackendFor(on) {
-	return require_discover.DEFAULT_CACHE[on];
-}
-/** Where a declared bucket lives on a target. */
-function storageBackendFor(on) {
-	return require_discover.DEFAULT_STORAGE[on];
-}
-/**
-* Which broker carries declared queues and topics on a target.
-*
-* Only consulted when something declares one; a project with no `Topic` or
-* `Queue` has no events at all, whatever the target.
-*/
-function eventsBackendFor(on) {
-	return require_discover.DEFAULT_EVENTS[on];
-}
-//#endregion
 //#region src/reconcile/containers.ts
 /**
 * What gkm knows about each container it can derive.
@@ -363,7 +309,8 @@ const PORTS = {
 	}, {
 		key: "minio-console",
 		inside: 9001,
-		label: "minio console"
+		label: "minio console",
+		web: true
 	}],
 	mailpit: [{
 		key: "mailpit",
@@ -372,7 +319,8 @@ const PORTS = {
 	}, {
 		key: "mailpit-web",
 		inside: 8025,
-		label: "mailpit inbox"
+		label: "mailpit inbox",
+		web: true
 	}],
 	redis: [{
 		key: "redis",
@@ -391,7 +339,8 @@ const PORTS = {
 	}, {
 		key: "rabbitmq-management",
 		inside: 15672,
-		label: "rabbitmq console"
+		label: "rabbitmq console",
+		web: true
 	}],
 	localstack: [{
 		key: "localstack",
@@ -423,6 +372,29 @@ function portsOf(container, fakes = {}) {
 	}];
 	return PORTS[container] ?? [];
 }
+/**
+* Every port the containers publish — not only the one an app connects to.
+*
+* The consoles and the inbox are most of why these are real containers, and an
+* inbox nobody can find is an inbox nobody opens: a sign-in link gets fished
+* out of `docker ps` instead.
+*/
+function serviceAddresses(containers, ports, fakes = {}) {
+	return containers.flatMap((container) => portsOf(container, fakes).flatMap((port) => {
+		const assigned = ports[port.key];
+		if (assigned === void 0) return [];
+		return [{
+			container,
+			label: port.label,
+			address: port.web ? `http://localhost:${assigned}` : `localhost:${assigned}`
+		}];
+	}));
+}
+/** The lines `gkm dev` and `gkm setup` print under the services heading. */
+function describeServices(services) {
+	const width = Math.max(0, ...services.map(({ label }) => label.length));
+	return services.map(({ label, address }) => `   ${label.padEnd(width)}  ${address}`);
+}
 /** The key a container's primary port is allocated under. */
 function primaryPortKey(container) {
 	return portsOf(container)[0]?.key ?? container;
@@ -748,6 +720,7 @@ const CACHE_CONTAINERS = {
 const CONTAINERLESS = {
 	secret: true,
 	credential: true,
+	encryption: true,
 	"rest-api": true,
 	site: true,
 	"mobile-app": true,
@@ -844,7 +817,7 @@ function resourceName(id, kind, stage, localStage) {
 * broker the project selected, which is why the backend is an argument here
 * rather than a second pass that adds containers after the fact.
 */
-function containerFor(kind, events = DEFAULT_EVENTS, cache = require_discover.DEFAULT_CACHE.aws, derived = false, edge = true) {
+function containerFor(kind, events = DEFAULT_EVENTS, cache = require_ready.DEFAULT_CACHE.aws, derived = false, edge = true) {
 	if (EVENT_KINDS[kind]) return EVENT_CONTAINERS[events] ?? CONTAINERS.database;
 	if (kind === "file-server") return edge ? "caddy" : CONTAINERS.objects;
 	if (kind === "cache") {
@@ -865,7 +838,7 @@ function planFor(manifest, stage, order, options = {}) {
 	const resources = [];
 	const fakes = {};
 	const events = options.events ?? "pgboss";
-	const cache = options.cache ?? require_discover.DEFAULT_CACHE.aws;
+	const cache = options.cache ?? require_ready.DEFAULT_CACHE.aws;
 	for (const id of order) {
 		const declaration = manifest[id];
 		if (!declaration) continue;
@@ -1212,6 +1185,7 @@ function workerBroker(plan, ports) {
 */
 function urlFor(resource, plan, ports, project, addresses = {}) {
 	if (resource.kind === "secret") return localSecret(project, plan, resource);
+	if (resource.kind === "encryption") return localKeyring(project, plan, resource);
 	if (resource.kind === "mobile-app") return (0, _geekmidas_manifest.schemeBase)(project, resource.scheme);
 	if (resource.kind === "credential") return void 0;
 	if (resource.kind === "external-api") {
@@ -1387,6 +1361,24 @@ var UnprovisionedEventsBackend = class extends Error {
 	}
 };
 /**
+* The keyring an `Encryption` construct resolves to locally.
+*
+* Derived like a secret — stable across restarts, distinct per project, stage
+* and construct, never written to disk — so what `gkm dev` encrypted yesterday
+* still opens today. One key, because nothing local is worth rotating: a
+* server stage's keyring is generated and rotated in its secrets instead.
+*/
+function localKeyring(project, plan, resource) {
+	const derive = (purpose) => (0, node_crypto.createHash)("sha256").update(`${project}:${plan.stage}:${resource.id}:${purpose}`).digest();
+	return (0, _geekmidas_constructs_encryption.formatKeyring)({
+		keys: [{
+			id: "k1",
+			key: derive("k1")
+		}],
+		index: derive("index")
+	});
+}
+/**
 * The value a secret resolves to locally.
 *
 * A hash of what identifies it, so it is stable, distinct per project, stage
@@ -2718,7 +2710,7 @@ async function reconcile(options) {
 		caddyfile,
 		postgres: postgresStatements(plan, project).map((statement) => statement.create).join(";\n")
 	});
-	const addresses = addressesFor(plan.containers, ports);
+	const services = serviceAddresses(plan.containers, ports, plan.fakes);
 	const lan = plan.resources.some((r) => r.kind === "mobile-app") ? options.lanAddress === void 0 ? lanAddress() : options.lanAddress ?? void 0 : void 0;
 	const env = envFor(plan, {
 		ports,
@@ -2734,7 +2726,7 @@ async function reconcile(options) {
 		plan,
 		compose,
 		ports,
-		addresses,
+		services,
 		env,
 		provisioned: [],
 		fakes: options.fakes ?? {},
@@ -2806,20 +2798,6 @@ async function observedPorts(docker, composePath, containers, fakes) {
 	}
 	return observed;
 }
-/**
-* Where each container can be reached on this machine.
-*
-* The primary port only — a container's console is for a human to open, not
-* something an app connects to.
-*/
-function addressesFor(containers, ports) {
-	const addresses = {};
-	for (const container of containers) {
-		const port = ports[primaryPortKey(container)];
-		if (port !== void 0) addresses[container] = `localhost:${port}`;
-	}
-	return addresses;
-}
 /** Write a file only when its content would change, so mtimes stay meaningful. */
 /**
 * Remove the routes of stages this project no longer reconciles.
@@ -2876,10 +2854,10 @@ function constructGlobs(workspace) {
 }
 /** The backends a workspace's target implies, as the plan takes them. */
 function backendsOf(workspace) {
-	const on = providerOf(workspace);
+	const on = require_backends.providerOf(workspace);
 	return {
-		events: eventsBackendFor(on),
-		cache: cacheBackendFor(on)
+		events: require_backends.eventsBackendFor(on),
+		cache: require_backends.cacheBackendFor(on)
 	};
 }
 /**
@@ -3022,12 +3000,6 @@ Object.defineProperty(exports, "backendsOf", {
 		return backendsOf;
 	}
 });
-Object.defineProperty(exports, "cacheBackendFor", {
-	enumerable: true,
-	get: function() {
-		return cacheBackendFor;
-	}
-});
 Object.defineProperty(exports, "constructGlobs", {
 	enumerable: true,
 	get: function() {
@@ -3052,10 +3024,10 @@ Object.defineProperty(exports, "derivedContainers", {
 		return derivedContainers;
 	}
 });
-Object.defineProperty(exports, "eventsBackendFor", {
+Object.defineProperty(exports, "describeServices", {
 	enumerable: true,
 	get: function() {
-		return eventsBackendFor;
+		return describeServices;
 	}
 });
 Object.defineProperty(exports, "fakeKey", {
@@ -3118,12 +3090,6 @@ Object.defineProperty(exports, "primaryPortKey", {
 		return primaryPortKey;
 	}
 });
-Object.defineProperty(exports, "providerOf", {
-	enumerable: true,
-	get: function() {
-		return providerOf;
-	}
-});
 Object.defineProperty(exports, "quoteIdentifier", {
 	enumerable: true,
 	get: function() {
@@ -3148,12 +3114,6 @@ Object.defineProperty(exports, "rootSite", {
 		return rootSite;
 	}
 });
-Object.defineProperty(exports, "storageBackendFor", {
-	enumerable: true,
-	get: function() {
-		return storageBackendFor;
-	}
-});
 Object.defineProperty(exports, "workspace_exports", {
 	enumerable: true,
 	get: function() {
@@ -3161,4 +3121,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=workspace-dV6f-3vv.cjs.map
+//# sourceMappingURL=workspace-vafrzZTC.cjs.map