@geekmidas/cli 10.0.0-alpha.46 → 10.0.0-alpha.47

package/dist/index.cjs

@@ -6,10 +6,11 @@ const require_config = require("./config-CsYSyUya.cjs");
 const require_workspace = require("./workspace-DEibcoBe.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
 const require_store = require("./store-DQgxT_WR.cjs");
-const require_workspace$1 = require("./workspace-D9z2ymBW.cjs");
+const require_workspace$1 = require("./workspace-vafrzZTC.cjs");
 const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-BN0PIZxd.cjs");
 const require_openapi = require("./openapi.cjs");
-const require_ready = require("./ready-L7I68yXf.cjs");
+const require_ready = require("./ready-lr2Fm-ep.cjs");
+const require_backends = require("./backends-B9V2XD2M.cjs");
 const require_emit = require("./emit-Dmc1nvdS.cjs");
 let commander = require("commander");
 let node_process = require("node:process");
@@ -28,6 +29,7 @@ let chokidar = require("chokidar");
 chokidar = require_rolldown_runtime.__toESM(chokidar, 1);
 let node_crypto = require("node:crypto");
 let node_url = require("node:url");
+let _geekmidas_constructs_encryption = require("@geekmidas/constructs/encryption");
 let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let pg = require("pg");
 let yaml = require("yaml");
@@ -46,7 +48,7 @@ let _geekmidas_constructs_queue = require("@geekmidas/constructs/queue");
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 let node_dns_promises = require("node:dns/promises");
 //#region package.json
-var version = "10.0.0-alpha.46";
+var version = "10.0.0-alpha.47";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -1184,7 +1186,7 @@ async function devCommand(options) {
 		appRoot,
 		target: "server",
 		enableOpenApi,
-		cacheBackend: require_workspace$1.cacheBackendFor(require_workspace$1.providerOf(workspace ?? config)),
+		cacheBackend: require_backends.cacheBackendFor(require_backends.providerOf(workspace ?? config)),
 		telescope,
 		studio,
 		hooks,
@@ -1202,9 +1204,9 @@ async function devCommand(options) {
 			stage: workspace.stages.local,
 			...options.fake ? { fake: true } : {}
 		});
-		if (reconciled.changed && reconciled.plan.containers.length > 0) {
-			logger$9.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-			for (const [container, address] of Object.entries(reconciled.addresses)) logger$9.log(`   ${container}: ${address}`);
+		if (reconciled.services.length > 0) {
+			logger$9.log("🐳 Services");
+			for (const line of require_workspace$1.describeServices(reconciled.services)) logger$9.log(line);
 		}
 		Object.assign(appSecrets, reconciled.env);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && require_config.appKey(r.id) === workspaceAppName);
@@ -1485,9 +1487,9 @@ async function workspaceDevCommand(workspace, options) {
 		stage: workspace.stages.local,
 		...options.fake ? { fake: true } : {}
 	});
-	if (reconciled.changed && reconciled.plan.containers.length > 0) {
-		logger$9.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-		for (const [container, address] of Object.entries(reconciled.addresses)) logger$9.log(`   ${container}: ${address}`);
+	if (reconciled.services.length > 0) {
+		logger$9.log("🐳 Services");
+		for (const line of require_workspace$1.describeServices(reconciled.services)) logger$9.log(line);
 	}
 	const secretsEnv = {
 		...rawSecrets,
@@ -1496,9 +1498,9 @@ async function workspaceDevCommand(workspace, options) {
 	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
 	for (const { id, port } of fakes) logger$9.log(`🎭 ${id} fake: http://localhost:${port}`);
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-Dp5HFzuQ.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-BgEY9pdP.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-Dp5HFzuQ.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-BgEY9pdP.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$9.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2633,7 +2635,7 @@ async function buildCommand(options) {
 		}
 	}
 	const config = loadedConfig.type !== "workspace" ? await require_config.loadConfig() : (0, node_path.resolve)(process.cwd()) === (0, node_path.resolve)(loadedConfig.workspace.root) ? rootGkmConfig(loadedConfig.workspace) : (await require_config.loadAppConfig()).gkmConfig;
-	const target = options.provider ?? require_workspace$1.providerOf(loadedConfig.workspace);
+	const target = options.provider ?? require_backends.providerOf(loadedConfig.workspace);
 	const workspaceRoot = loadedConfig.workspace.root;
 	const appRoot = process.cwd();
 	const output = await buildOneApp({
@@ -2665,14 +2667,14 @@ async function declaredIn(config, cwd) {
 */
 function backendsOf(workspace) {
 	return {
-		cache: require_workspace$1.cacheBackendFor(require_workspace$1.providerOf(workspace)),
+		cache: require_backends.cacheBackendFor(require_backends.providerOf(workspace)),
 		email: "ses"
 	};
 }
 /** One app's build, from its config and the command's options. */
 async function buildOneApp(input) {
 	const { config, options, workspace, appRoot, target } = input;
-	const cacheBackend = require_workspace$1.cacheBackendFor(require_workspace$1.providerOf(workspace));
+	const cacheBackend = require_backends.cacheBackendFor(require_backends.providerOf(workspace));
 	const production = normalizeProductionConfig(options.production ?? false);
 	if (production) logger$8.log(`🏭 Building for PRODUCTION`);
 	logger$8.log(`Building for ${target}`);
@@ -2975,7 +2977,7 @@ async function workspaceBuildCommand(workspace, options) {
 	const buildOrder = require_workspace.getAppBuildOrder(workspace);
 	logger$8.log(`   Build order: ${buildOrder.join(" → ")}`);
 	try {
-		const target = options.provider ?? require_workspace$1.providerOf(workspace);
+		const target = options.provider ?? require_backends.providerOf(workspace);
 		const builds = [];
 		for (const appName of buildOrder) {
 			const app = workspace.apps[appName];
@@ -3376,6 +3378,19 @@ const PROVISIONERS = {
 		return { provides: { [key]: supplied(declaration.id, key, context) } };
 	},
 	/**
+	* The keyring the stage keeps in its secrets.
+	*
+	* Generated on the first deploy (`withGeneratedSecrets`) and rotated only
+	* by `gkm encryption:rotate`, so a redeploy never changes a key and nothing
+	* written becomes unreadable. Nothing is created in Dokploy: the process
+	* holds the keyring.
+	*/
+	encryption: async (declaration, context) => {
+		if (declaration.kind !== "encryption") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "url");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
 	* A third party's credentials, as the stage was given them.
 	*
 	* Nothing is created and nothing derived: the value was issued by somebody
@@ -3745,9 +3760,9 @@ async function provisionDeclared(options) {
 		environmentId: options.environmentId,
 		stage: options.stage,
 		project: workspace.name,
-		cache: require_workspace$1.cacheBackendFor(require_workspace$1.providerOf(workspace)),
-		events: require_workspace$1.eventsBackendFor(require_workspace$1.providerOf(workspace)),
-		storage: require_workspace$1.storageBackendFor(require_workspace$1.providerOf(workspace)),
+		cache: require_backends.cacheBackendFor(require_backends.providerOf(workspace)),
+		events: require_backends.eventsBackendFor(require_backends.providerOf(workspace)),
+		storage: require_backends.storageBackendFor(require_backends.providerOf(workspace)),
 		addresses: surfaceAddresses(workspace, manifest, options.appUrls),
 		seed: options.seed,
 		...options.supplied ? { supplied: options.supplied } : {},
@@ -6385,6 +6400,8 @@ function validateEnvVars(requiredVars, context) {
 *   who could read the repo.
 * - **Each `secret` construct's value** — an auth server's signing secret —
 *   random, rather than derived.
+* - **Each `encryption` construct's keyring** — one random key and an index
+*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
 *
 * Both are generated on the first deploy that needs them and written to the
 * stage's store, so every later deploy reads the same values: sessions survive
@@ -6400,10 +6417,10 @@ function withGeneratedSecrets(secrets, manifest) {
 	const generated = [];
 	const custom = { ...secrets.custom };
 	for (const declaration of Object.values(manifest)) {
-		if (declaration?.kind !== "secret") continue;
+		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
 		const key = declaration.provides?.[0];
 		if (!key || custom[key]) continue;
-		custom[key] = random();
+		custom[key] = declaration.kind === "encryption" ? (0, _geekmidas_constructs_encryption.generateKeyring)() : random();
 		generated.push(key);
 	}
 	const seed = secrets.seed ?? random();
@@ -9077,26 +9094,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.46",
-	"@geekmidas/auth": "~10.0.0-alpha.46",
-	"@geekmidas/cache": "~10.0.0-alpha.46",
-	"@geekmidas/client": "~10.0.0-alpha.46",
-	"@geekmidas/cloud": "~10.0.0-alpha.46",
-	"@geekmidas/constructs": "~10.0.0-alpha.46",
-	"@geekmidas/db": "~10.0.0-alpha.46",
-	"@geekmidas/emailkit": "~10.0.0-alpha.46",
-	"@geekmidas/envkit": "~10.0.0-alpha.46",
-	"@geekmidas/errors": "~10.0.0-alpha.46",
-	"@geekmidas/events": "~10.0.0-alpha.46",
-	"@geekmidas/logger": "~10.0.0-alpha.46",
-	"@geekmidas/manifest": "~10.0.0-alpha.46",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.46",
-	"@geekmidas/schema": "~10.0.0-alpha.46",
-	"@geekmidas/services": "~10.0.0-alpha.46",
-	"@geekmidas/storage": "~10.0.0-alpha.46",
-	"@geekmidas/studio": "~10.0.0-alpha.46",
-	"@geekmidas/telescope": "~10.0.0-alpha.46",
-	"@geekmidas/testkit": "~10.0.0-alpha.46",
+	"@geekmidas/audit": "~10.0.0-alpha.47",
+	"@geekmidas/auth": "~10.0.0-alpha.47",
+	"@geekmidas/cache": "~10.0.0-alpha.47",
+	"@geekmidas/client": "~10.0.0-alpha.47",
+	"@geekmidas/cloud": "~10.0.0-alpha.47",
+	"@geekmidas/constructs": "~10.0.0-alpha.47",
+	"@geekmidas/db": "~10.0.0-alpha.47",
+	"@geekmidas/emailkit": "~10.0.0-alpha.47",
+	"@geekmidas/envkit": "~10.0.0-alpha.47",
+	"@geekmidas/errors": "~10.0.0-alpha.47",
+	"@geekmidas/events": "~10.0.0-alpha.47",
+	"@geekmidas/logger": "~10.0.0-alpha.47",
+	"@geekmidas/manifest": "~10.0.0-alpha.47",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.47",
+	"@geekmidas/schema": "~10.0.0-alpha.47",
+	"@geekmidas/services": "~10.0.0-alpha.47",
+	"@geekmidas/storage": "~10.0.0-alpha.47",
+	"@geekmidas/studio": "~10.0.0-alpha.47",
+	"@geekmidas/telescope": "~10.0.0-alpha.47",
+	"@geekmidas/testkit": "~10.0.0-alpha.47",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -15505,8 +15522,8 @@ async function reconcileLocal(workspace, stage, options) {
 		logger$1.log("🐳 Services already up to date");
 		return;
 	}
-	logger$1.log(`🐳 Services: ${result.plan.containers.join(", ")}`);
-	for (const [container, address] of Object.entries(result.addresses)) logger$1.log(`   ${container}: ${address}`);
+	logger$1.log("🐳 Services");
+	for (const line of require_workspace$1.describeServices(result.services)) logger$1.log(line);
 	const url = result.plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site" || r.kind === "file-server").map((r) => result.env[r.envKey]).find((address) => address?.startsWith("https://"));
 	if (url) await ensureTrusted(workspace.root, url, { ...options.yes ? { assumeYes: true } : {} });
 }
@@ -15853,7 +15870,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-Dp5HFzuQ.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-BgEY9pdP.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-DXNviAh-.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -16284,7 +16301,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-Dp5HFzuQ.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-BgEY9pdP.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16298,7 +16315,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-Dp5HFzuQ.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-BgEY9pdP.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16312,7 +16329,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-Dp5HFzuQ.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-BgEY9pdP.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16406,6 +16423,28 @@ program.command("secrets:set").description("Set a custom secret for a stage").ar
 		process.exit(1);
 	}
 });
+program.command("encryption:rotate").description("Add a new current key to an Encryption construct's keyring on a server stage").argument("<construct>", "The Encryption construct (e.g. Pii)").requiredOption("--stage <stage>", "A deployed stage").action(async (construct, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { encryptionRotateCommand } = await Promise.resolve().then(() => require("./encryption-C7OGMve_.cjs"));
+		await encryptionRotateCommand(construct, options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
+program.command("encryption:retire").description("Remove an old key from an Encryption construct's keyring, once nothing is under it").argument("<construct>", "The Encryption construct (e.g. Pii)").argument("<key>", "The key to retire (e.g. k1)").requiredOption("--stage <stage>", "A deployed stage").action(async (construct, key, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { encryptionRetireCommand } = await Promise.resolve().then(() => require("./encryption-C7OGMve_.cjs"));
+		await encryptionRetireCommand(construct, key, options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("secrets:show").description("Show secrets for a stage").requiredOption("--stage <stage>", "Stage name").option("--reveal", "Show actual secret values (not masked)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -16451,7 +16490,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-D9z2ymBW.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-vafrzZTC.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);